cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
444
Views
0
Helpful
2
Replies

site to site vpn routing problem

hi all i have a problem with some routing. have a 501 pix at my home site that connects to our companys system through a cisco 2621 router in a site to site vpn. i need to have traffic to a certain destination go through our companies def gateway for authentication to the dest site. here is what i have done so far.

2621 config

Crypto Map "VDM_CMAP_0" 17 ipsec-isakmp

Description: VDM:MRC

Peer = *.*.232.244

Extended IP access list VDM_ACL_16

access-list VDM_ACL_16 permit ip 10.0.0.0 0.0.255.255 10.0.50.0 0.0.0.255

Current peer: *.*.232.244

Security association lifetime: 4608000 kilobytes/86400 seconds

PFS (Y/N): N

Transform sets={

myset,

}

Interfaces using crypto map VDM_CMAP_0:

FastEthernet0/1

Crypto Map "outside_map_1" 10 ipsec-isakmp

Peer = *.23.64.5

access-list outside_cryptomap_10; 2 elements

access-list outside_cryptomap_10 line 1 permit ip 10.0.50.0 255.255.255.0 10.0.0.0 255.255.0.0 access-list outside_cryptomap_10 line 2 remark router tools

access-list outside_cryptomap_10 line 3 permit ip 10.0.50.0 255.255.255.0 192.75.26.0 255.255.255.0

Current peer: *.23.64.5

Security association lifetime: 4608000 kilobytes/28800 seconds

PFS (Y/N): N

Transform sets={ myset, }

the dest address 192.75.26.0 i need to come back to me. can someone tell me please what i have done wrong. thanks

2 Replies 2

correction on the 2621 crypto map

2621 config

Crypto Map "VDM_CMAP_0" 17 ipsec-isakmp

Description: VDM:MRC

Peer = *.*.232.244

Extended IP access list VDM_ACL_16

access-list VDM_ACL_16 permit ip 10.0.0.0 0.0.255.255 10.0.50.0 0.0.0.255

access-list VDM_ACL_16 permit ip 192.75.26.0 0.0.255.255 10.0.50.0 0.0.0.255

Current peer: *.*.232.244

Security association lifetime: 4608000 kilobytes/86400 seconds

PFS (Y/N): N

Transform sets={

myset,

}

Interfaces using crypto map VDM_CMAP_0:

FastEthernet0/1

ccie9567
Level 1
Level 1

Hello Michale,

Your access list do not match both sides.

Remember it has to be same on both sides.I would say mirror copy.

Good luck..