Thanks,
I'll have to change it then? Here is what I get now on the pix with sh crypto ipsec sa:
interface: outside
Crypto map tag: outside_map, local addr. x.x.x.x
local ident (addr/mask/prot/port): (172.16.20.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.0.0/255.255.0.0/0/0)
current_peer: x.x.x.x:500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 865, #pkts encrypt: 865, #pkts digest 865
#pkts decaps: 612, #pkts decrypt: 612, #pkts verify 612
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: x.x.x.x, remote crypto endpt.: x.x.x.x
path mtu 1500, ipsec overhead 72, media mtu 1500
current outbound spi: cf6e850e
inbound esp sas:
spi: 0x706bd01a(1886113818)
transform: esp-aes esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 4, crypto map: outside_map
sa timing: remaining key lifetime (k/sec): (4607939/1099)
IV size: 16 bytes
replay detection support: Y
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xcf6e850e(3480126734)
transform: esp-aes esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 3, crypto map: outside_map
sa timing: remaining key lifetime (k/sec): (4607977/1099)
IV size: 16 bytes
replay detection support: Y
outbound ah sas:
outbound pcp sas:
local ident (addr/mask/prot/port): (172.16.20.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (10.10.0.0/255.255.0.0/0/0)
current_peer: x.x.x.x:0
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
#send errors 103, #recv errors 0
local crypto endpt.: x.x.x.x, remote crypto endpt.: x.x.x.x
path mtu 1500, ipsec overhead 0, media mtu 1500
current outbound spi: 0
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
So it is definately trying to protect the right traffic...it just isn't successful in creating an sa.
oops, I just realized it was a different pix that I was trying to get to work. That is why the subnets look different from my first post. This is what I got on the other one as well, when trying to add another subnet to the VPN. This particular pix is actually connection to a smoothwall firewall. The VPN works great but only with one subnet. Is there a way to set up this multiple routing with a smoothwall, since you can't set it up with a crypto map.
