Pix 506 & 501 site-to-site VPN question.

The 506e has a max limit of 20 IPsec tunnels so you should be ok for licensing. One problem I came across with multiple tunnels is that you can't have more than one crypto map. Instead, you have to give each additional tunnel a new priority. For example:

no crypto map outside_map1 10 match address outside1 no crypto map outside_map1 10 set peer 10.10.0.3 no crypto map outside_map1 10 set transform-set ESP-3DES-SHA

no crypto map outside_map2 10 match address outside2 no crypto map outside_map2 10 set peer 10.20.0.3 no crypto map outside_map2 10 set transform-set ESP-3DES-SHA

crypto map outside_map 10 match address outside_cryptomap_10 crypto map outside_map 10 set peer 10.10.0.3 crypto map outside_map 10 set transform-set ESP-3DES-SHA

crypto map outside_map 20 match address outside_cryptomap_20 crypto map outside_map 20 set peer 10.20.0.3 crypto map outside_map 20 set transform-set ESP-3DES-SHA

access-list outside_cryptomap_10 extended permit ip 10.1.0.0 255.255.0.0

192.168.1.0 255.255.255.0 access-list outside_cryptomap_20 extended permit ip 10.2.0.0 255.255.0.0 192.168.2.0 255.255.255.0

tunnel-group 10.10.0.3 type ipsec-l2l tunnel-group 10.10.0.3 ipsec-attributes pre-shared-key foo

tunnel-group 10.20.0.3 type ipsec-l2l tunnel-group 10.20.0.3 ipsec-attributes pre-shared-key bar

ok this is part of my current config at the main office pix 506.

access-list Non-Nat permit ip 192.168.0.0 255.255.255.0 192.168.1.0

255.255.255.0 #This is internal local Office IP access-list Non-Nat permit ip 192.168.0.0 255.255.255.0 192.168.2.0 255.255.255.0 #This is the remote Office1 IP (the one that works) access-list Non-Nat permit ip 192.168.0.0 255.255.255.0 192.168.3.0 255.255.255.0 #This is the remote Office2 IP (one i'm trying to setup) access-list Split-Tun permit ip 192.168.0.0 255.255.255.0 192.168.2.0 255.255.255.0 #Remote Office1 access-list Split-Tun3 permit ip 192.168.0.0 255.255.255.0 192.168.3.0 255.255.255.0 #Remote Office2 ..... timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute ...... sysopt connection permit-ipsec sysopt connection permit-pptp crypto ipsec transform-set Trans-1 esp-3des esp-sha-hmac crypto dynamic-map CovConn-Dyno 10 set transform-set Trans-1 crypto map CovConn-VPN 10 ipsec-isakmp dynamic CovConn-Dyno crypto map CovConn-VPN client authentication MS-IAS crypto map CovConn-VPN interface outside isakmp enable outside isakmp policy 10 authentication pre-share isakmp policy 10 encryption 3des isakmp policy 10 hash sha isakmp policy 10 group 2 isakmp policy 10 lifetime 86400 vpngroup CovConn-Group1 address-pool IP-Pool1 #CovConn-Group1 is used for home users to vpn to network. vpngroup CovConn-Group1 dns-server 192.168.0.5 192.168.0.6 vpngroup CovConn-Group1 default-domain cci.local vpngroup CovConn-Group1 idle-time 1800 vpngroup CovConn-Group1 password ******** vpngroup CovConn-Group2 address-pool IP-Pool2 #CovConn-Group2 is used for Remote Office1 VPN Tunnel, which currently works. vpngroup CovConn-Group2 dns-server 192.168.0.5 192.168.0.6 vpngroup CovConn-Group2 default-domain cci.local vpngroup CovConn-Group2 split-tunnel Split-Tun vpngroup CovConn-Group2 idle-time 1800 vpngroup CovConn-Group2 password ******** vpngroup CovConn-Group3 address-pool IP-Pool3 #CovConn-Group3 is the one not working i'm trying to setup. vpngroup CovConn-Group3 dns-server 192.168.0.5 192.168.0.6 vpngroup CovConn-Group3 default-domain cci.local vpngroup CovConn-Group3 split-tunnel Split-Tun3 vpngroup CovConn-Group3 idle-time 1800 vpngroup CovConn-Group3 password ********

This is the config of the pix501 at Remote Office2.

..... ip address outside pppoe setroute ip address inside 192.168.3.1 255.255.255.0 ip audit info action alarm ip audit attack action alarm ...... global (outside) 1 interface nat (inside) 1 0.0.0.0 0.0.0.0 0 0 timeout xlate 0:05:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225

1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local ..... vpdn group PPPOE request dialout pppoe vpdn group PPPOE localname ***** vpdn group PPPOE ppp authentication pap vpdn username ******* password ********* dhcpd address 192.168.3.50-192.168.3.65 inside dhcpd lease 3600 dhcpd ping_timeout 750 dhcpd enable inside dhcprelay timeout 60 username ****** password ****** encrypted privilege 15 vpnclient server *IP ADDRESS OF OUTSIDE MAIN OFFICE* vpnclient mode network-extension-mode vpnclient vpngroup CovConn-Group3 password ******** vpnclient username ******* password ****** vpnclient enable

"Gary" wrote in message news: snipped-for-privacy@efn.org...

Please post the IPsec portion of your 501's config. Also, what version of firmware are you using on the two devices. I see vpdn commands so it's definitely < 7.

Thanks, Gary

the pix 501 is using PIX version 6.3(4) and the 506 is using 6.3(3)

there's no IPsec commands on the 501. I posted any of the relevent vpn info. I've made 1 change on the 506 last night and it seems to be working now.