I have 2 pix firewalls i have VPN site to site and it works i had VPN server (cisco VPN client) after i put VPN Site-2-SIte VPN server does not work
this is my config for a Office and remote site Office PIX Version 6.3(4) interface ethernet0 auto interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 access-list outside_access_in permit icmp any any log access-list 101 permit ip 192.168.1.0 255.255.255.0 192.168.2.0
255.255.255.0 access-list 101 permit ip 192.168.1.0 255.255.255.0 80.80.80.112 255.255.255.240 ip address outside 90.90.90.18 255.255.255.240 ip address inside 192.168.1.1 255.255.255.0 global (outside) 10 interface nat (inside) 0 access-list 101 nat (inside) 10 0.0.0.0 0.0.0.0 0 0 route outside 0.0.0.0 0.0.0.0 90.90.90.17 1 sysopt connection permit-ipsec crypto ipsec transform-set myset esp-des esp-md5-hmac crypto ipsec transform-set strong esp-3des esp-sha-hmac crypto dynamic-map dynmap 10 set transform-set myset crypto map inside_map interface inside crypto map mymap 10 ipsec-isakmp dynamic dynmap crypto map SiteToSite 10 ipsec-isakmp crypto map SiteToSite 10 match address 101 crypto map SiteToSite 10 set peer 80.80.66.239 crypto map SiteToSite 10 set transform-set strong crypto map SiteToSite interface outside isakmp enable outside isakmp key ******** address 80.80.66.239 netmask 255.255.255.255 isakmp nat-traversal 10 isakmp policy 9 authentication pre-share isakmp policy 9 encryption 3des isakmp policy 9 hash sha isakmp policy 9 group 1 isakmp policy 9 lifetime 86400 isakmp policy 10 authentication pre-share isakmp policy 10 encryption des isakmp policy 10 hash md5 isakmp policy 10 group 2 isakmp policy 10 lifetime 86400 vpngroup mygroup1 address-pool ippool vpngroup mygroup1 dns-server 192.168.1.2 vpngroup mygroup1 wins-server 192.168.1.2 vpngroup mygroup1 default-domain l.com vpngroup mygroup1 split-tunnel 101 vpngroup mygroup1 idle-time 1800 vpngroup mygroup1 password ********Remote Site
PIX Version 6.3(4) interface ethernet0 auto interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 access-list outside_access_in permit icmp any any log access-list 101 permit ip 80.80.80.112 255.255.255.240 192.168.2.0
255.255.255.0 access-list 101 permit ip 80.80.80.112 255.255.255.248 192.168.2.0 255.255.255.0 access-list 101 permit ip 80.80.80.112 255.255.255.240 192.168.1.0 255.255.255.0 ip address outside 80.80.66.239 255.255.254.0 ip address inside 80.80.80.113 255.255.255.240 ip local pool ippool 192.168.2.1-192.168.2.40 global (outside) 100 interface nat (inside) 0 access-list 101 nat (inside) 10 0.0.0.0 0.0.0.0 0 0 route outside 0.0.0.0 0.0.0.0 80.80.66.1 1 sysopt connection permit-ipsec crypto ipsec transform-set myset esp-des esp-md5-hmac crypto ipsec transform-set strong esp-3des esp-sha-hmac crypto dynamic-map dynmap 10 set transform-set myset crypto map inside_map interface inside crypto map mymap 10 ipsec-isakmp dynamic dynmap crypto map newyork 20 ipsec-isakmp crypto map newyork 20 match address 101 crypto map newyork 20 set peer 90.90.90.18 crypto map newyork 20 set transform-set strong crypto map newyork interface outside isakmp enable outside isakmp key ******** address 90.90.90.18 netmask 255.255.255.255 isakmp nat-traversal 10 isakmp policy 8 authentication pre-share isakmp policy 8 encryption 3des isakmp policy 8 hash sha isakmp policy 8 group 1 isakmp policy 8 lifetime 86400 isakmp policy 10 authentication pre-share isakmp policy 10 encryption des isakmp policy 10 hash md5 isakmp policy 10 group 2 isakmp policy 10 lifetime 86400 vpngroup mygroup1 address-pool ippool vpngroup mygroup1 dns-server 80.80.80.115 vpngroup mygroup1 wins-server 80.80.80.115 vpngroup mygroup1 default-domain al.com vpngroup mygroup1 split-tunnel 101 vpngroup mygroup1 idle-time 1800 vpngroup mygroup1 password ********