icmp type 11 cause pix to deny traffic

check the access-list once again.

I did, belive me I did. I am using IPSEC tunnels and everything works ok until this ICMKP type 11 shows up. After that UDP from ipsec peers port 500 is denied

In article , Drx wrote: :I did, belive me I did. I am using IPSEC tunnels and everything works ok :until this ICMKP type 11 shows up. After that UDP from ipsec peers port 500 :is denied

icmp 11/0 is TTL Exceeded.

Your original posting had this being recorded as generated by x.x.x.6 and detected by the PIX.

For the denied udp 500 packets, are they destined for x.x.x.6 ?

Is that host NAT'd, or static'd to itself, or nat 0'd or nat 0 access-list'd ?

Do you have isakmp nat-traversal 20 turned on?

In article , wrote: :x.x.x.6 is router from wich peers are coming. x.x.x.5 is outside int of :pix. peer packets are destined for x.x.x.5, pix interface.

I just wandered across your initial thread, with your config, which showed you are using PIX 7.0. It's good to indicate version numbers with each thread, as people might not have read the other thread (or might not make the mention connection between the two.)

Anyhow, I notice that the IDS message you are getting, notifying of the ICMP 11/0, is against the *inside* interface, but your router x.x.x.6 is on your *outside* interface (if I have understood correctly.) This suggests that something inside is spoofing the router address, and that the PIX is getting confused by that.

You might want to turn on the PIX 7.0 equivilent of reverse path verification.

x.x.x.6 is router from wich peers are coming. x.x.x.5 is outside int of pix. peer packets are destined for x.x.x.5, pix interface. I do not have isakmp nat-traversla because peers are not nat-ed. I must point out that everthing is working fine for some time. I do not understand how can it works fine for 20 hours or so and then stops working.

thanks

yes you understood correctly, message indicates traffic against inside interface. It was strange to me also, I will go in antispoof direction :-)) but mybe something is wrong with pix code.