Hello everybody, I've run into problems setting up a syslog logging on a remote PIX-501. Here's the scoop - 192.168.20.0 is the Head office network,
192.168.28.0 is connected via an IPSEC VPN. There's a UNIX box in the Head Office at 192.168.20.2. Workstations in the remote branch have no problems connecting to it and I can ping them across VPN from the UNIX box. However, I'm unable to reach the internal interface of the remote PIX at 192.168.28.1. Likewise, I can not ping the UNIX box from 192.168.28.1 and get the error "110001: No route to 192.168.20.2 from 192.168.28.1". What am I missing here?The PIX configuration: =========================headoffice================================ PIX Version 6.3(4) nameif ethernet0 outside security0 nameif ethernet1 inside security100 fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol pptp 1723 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names name 142.XXX.XXX.46 vpn-south name 142.YYY.YYY.241 vpn-west access-list outside_access_in permit ip host vpn-south any log access-list outside_access_in permit ip host vpn-west any log access-list outside_access_in deny tcp any any log 5 access-list 102 permit ip 192.168.20.0 255.255.255.0 192.168.27.0
255.255.255.0 access-list 102 permit ip 192.168.20.0 255.255.255.0 192.168.28.0 255.255.255.0 access-list 102 permit ip any 192.168.20.240 255.255.255.240 access-list 102 permit ip 192.168.20.0 255.255.255.0 host vpn-west access-list 102 permit ip 192.168.20.0 255.255.255.0 host vpn-south access-list outside_cryptomap_20 permit ip 192.168.20.0 255.255.255.0 192.168.27.0 255.255.255.0 access-list outside_cryptomap_40 permit ip 192.168.20.0 255.255.255.0 192.168.28.0 255.255.255.0 icmp permit any inside mtu outside 1500 mtu inside 1500 ip address outside 209.ZZZ.ZZZ.14 255.255.255.0 ip address inside 192.168.20.254 255.255.255.0 ip audit info action alarm ip audit attack action alarm arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list 102 nat (inside) 1 0.0.0.0 0.0.0.0 0 0 static (inside,outside) tcp interface ssh 192.168.20.2 ssh netmask 255.255.255.255 0 0 access-group outside_access_in in interface outside route outside 0.0.0.0 0.0.0.0 209.ZZZ.ZZZ.1 1 timeout xlate 4:00:00 timeout conn 0:00:00 half-closed 0:00:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute sysopt connection permit-ipsec sysopt connection permit-pptp crypto ipsec transform-set transformset1 esp-des esp-md5-hmac crypto map outside_map 20 ipsec-isakmp crypto map outside_map 20 match address outside_cryptomap_20 crypto map outside_map 20 set peer vpn-south crypto map outside_map 20 set transform-set transformset1 crypto map outside_map 40 ipsec-isakmp crypto map outside_map 40 match address outside_cryptomap_40 crypto map outside_map 40 set peer vpn-west crypto map outside_map 40 set transform-set transformset1 crypto map outside_map interface outside isakmp enable outside isakmp key ******** address vpn-south netmask 255.255.255.255 no-xauth no-config-mode isakmp key ******** address vpn-west netmask 255.255.255.255 no-xauth no-config-mode isakmp policy 1 authentication pre-share isakmp policy 1 encryption des isakmp policy 1 hash md5 isakmp policy 1 group 1 isakmp policy 1 lifetime 1000 isakmp policy 21 authentication pre-share isakmp policy 21 encryption des isakmp policy 21 hash md5 isakmp policy 21 group 2 isakmp policy 21 lifetime 86400 : end ===============================remote==================== PIX Version 6.3(4) interface ethernet0 auto interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 hostname vpn-west fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names name 192.168.20.0 Headoffice name 209.ZZZ.ZZZ.14 HO-Internet access-list outside_access_in permit ip host HO-Internet any access-list outside_access_in deny ip any any log access-list inside_outbound_nat0_acl permit ip 192.168.28.0 255.255.255.0 Headoffice 255.255.255.0 access-list inside_outbound_nat0_acl permit ip 192.168.28.0 255.255.255.0 host HO-Internet access-list outside_cryptomap_20 permit ip 192.168.28.0 255.255.255.0 Headoffice 255.255.255.0 access-list inside_access_in permit ip 192.168.28.0 255.255.255.0 Headoffice 255.255.255.0 access-list inside_access_in remark Disallow all communication with the Internet access-list inside_access_in deny ip any any log mtu outside 1500 mtu inside 1500 ip address outside dhcp setroute ip address inside 192.168.28.1 255.255.255.0 ip audit info action alarm ip audit attack action alarm arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list inside_outbound_nat0_acl nat (inside) 1 0.0.0.0 0.0.0.0 0 0 access-group outside_access_in in interface outside access-group inside_access_in in interface inside timeout xlate 0:05:00 timeout conn 0:00:00 half-closed 0:00:00 udp 0:00:00 rpc 0:00:00 h225 0:00:00 timeout h323 0:00:00 mgcp 0:00:00 sip 0:00:00 sip_media 0:00:00 timeout uauth 0:00:00 absolute floodguard enable sysopt connection permit-ipsec crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac crypto map outside_map 20 ipsec-isakmp crypto map outside_map 20 match address outside_cryptomap_20 crypto map outside_map 20 set peer HO-Internet crypto map outside_map 20 set transform-set ESP-DES-MD5 crypto map outside_map interface outside isakmp enable outside isakmp key ******** address HO-Internet netmask 255.255.255.255 no-xauth no-config-mode isakmp policy 20 authentication pre-share isakmp policy 20 encryption des isakmp policy 20 hash md5 isakmp policy 20 group 2 isakmp policy 20 lifetime 86400 : end