VPN - IOS (Net Ext Mode) to PIX EzVPN Server???

[d-garnett]

Hello All,

Is it possible to do EzVPN from an IOS Router Client to a PIX EzVPN Server in Network Extension Mode?

I have done this in client mode w/o many issues, but it seems since PIX doesn't do RRI (I don't think) in the dynamic crypto map. I can not get this to work. I can not get traffic to pass.

I am trying to ping a host on the protected/LAN side of the PIX. The traffic goes from the IOS (gets encrypted) to the PIX (gets decrypted) and does not return. The host knows to go to the PIX to get to the IOS protected/LAN side, but the PIX has no "route" installed in it's routing table to get back to the IOS protected side. I have created a static route on the PIX, but still no good.

NAT 0/Exemption is also on for the Split Tunnel ACL networks (PIX LAN side to IOS LAN side).

When you do IOS/PIX EzVPN to VPN Concentrator (as EzVPN Server), the Route Prefix is added to the VPN 3000 Routing Table. However, it is not with the PIX as EzVPN Server.

Thanks

I have also seen the following: http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a00800ab518.shtml

Are there any examples for IOS EzVPN Client tot PIX EzVPN Server in NEM Mode?

[gfullage]

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a0080241a0d.shtml

This should certainly work, I don't believe there's anything specific with routing that you need to do. Certainly the PIX doesn't have the "reverse-route" feature on the crypto maps, but you shouldn't need it, and you won't see an entry in the PIX routing table for the remote subnet. As long as your main network behind the PIX has a route for the remote network, and that route points to the PIX then you should be OK.

On the PIX do you see "packet encaps" and "packet decaps" under the IPSec tunnel both incrementing? If you only see "decaps" then this indicates the PIX is receiving packets from the IOS client and forwarding them on internally, but is receiving nothing back. This would point to the routing problem I mentioned above.

If you see both "encaps" and "decaps" then the PIX is seeing th ereplies and encrypting them towards the IOS client, so you need to then check the "decaps" on that device to see if they're making it there.

By checking the "encaps" and "decaps" counters on both ends you can generally see where the packets are disappearing and where the problem lies.