troubleshooting VPN thru PIX

[tsrader]

PIX 525s between main network and another company. We permit VPN from their network thru ours to allow access to servers, email, etc. VPN has stopped working

How do i debug VPN traffic from their network (172.16.10.50) to ours (10.1.35.75) to see whether traffic is even coming thru the PIX firewall?

[jmia]

Troubleshooting Commands

Note: The clear commands must be performed in configuration mode.

clear crypto ipsec sa – Resets the IPSec associations after failed attempts to negotiate a VPN tunnel.

clear crypto isakmp sa – Resets the ISAKMP security associations after failed attempts to negotiate a VPN tunnel.

debug crypto ipsec – Shows if a client is negotiating the IPSec portion of the VPN connection.

debug crypto isakmp – Shows if the peers are negotiating the ISAKMP portion of the VPN connection.

All the above can be found here:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a0080094761.shtml

What's the output for: sho isakmp sa

And do you see encap / decap counts when you issues:

sho ipsec sa

One more thing, do you actually have L3 connectivity between the two peers? Can you ping from your PIX to your peers outside IP address (remove any icmp deny statements from both peers before issuing ping).

Hope this helps and please rate post if it does.

Jay