PIX525 - Setup ipsec tunnel to two Nortel FW sharing the same subnet

Try MD5 instead of SHA. 6.3 doesn't allow SHA with single-DES (I don't know why not.)

Hi Walter,

I tried with md5 and result is not better. For information if I change the subnet of my secondary Nortel FW to a different one (i.e: 192.168.106.0/24) then both ipsec tunnels are up and running!

I don't know why but it seems that the PIX doesn't like to have the same subnet shared with 2 different remote FW through ipsec tunnels.

Do you or somebody else have other ideas ?

cheers Fr=E9d=E9ric

You do not need to put the forward and backward flow into the same match-address ACL. Just the forward flow:

access-list 110 line 1 permit ip 192.168.104.0 255.255.255.0 192.168.105.0

255.255.255.0

and leave out the second line.

PIX always scans for matches from the highest priority (lowest number) to lowest. It stops when it finds a match. As your two address lists are identical, it is always going to match on the C1 5, and never going to get as far as C1 10. Even if the peer for C1 5 dies, the PIX will not get as far as C1 10. PIX 6.x also has no mechanism for load sharing.

I'm not clear from your posting whether the two nortel peers are at the same (virtual) IP address? If so then that is sure to cause problems, as the PIX makes its decisions based upon IP address -- problems, that is, if you want both to be active at the same time.

If you do NOT want both Nortel to be active at the same time, then only one of the two should be in contact with the PIX at a time and the PIX should be configured as

access-list 110 line 1 permit ip 192.168.104.0 255.255.255.0 192.168.105.0

255.255.255.0 crypto map C1 5 ipsec-isakmp crypto map C1 5 match address 110 crypto map C1 5 set peer 212.147.x.x crypto map C1 5 set transform-set set2

where 212.147.x.x is their (VRRP) shared IP address. In this situation the PIX should not be configured with any information about the second Nortel, because the failover to the second Nortel is supposed to be transparent in such a situation.

If you DO want both Nortel to be active at the same time, and both carrying part of the load, then configure something like

access-list 110 line 1 permit ip 192.168.104.0 255.255.255.0 192.168.105.0

255.255.255.128 access-list 120 line 1 permit ip 192.168.104.0 255.255.255.0 192.168.105.128 255.255.255.128

(that is, use the two lists to partition the destination traffic somehow), then

crypto map C1 5 ipsec-isakmp crypto map C1 5 match address 110 crypto map C1 5 set peer 212.147.x.1 crypto map C1 5 set transform-set set2 crypto map C1 10 ipsec-isakmp crypto map C1 10 match address 120 crypto map C1 10 set peer 212.147.x.2 crypto map C1 10 set transform-set set2

presuming that the surviving Nortel can take on both 212.147.x.1 and 212.147.x.2

If the Nortels cannot take on two IPs, then a more typical config would be,

access-list 110 line 1 permit ip 192.168.104.0 255.255.255.0 192.168.105.0

255.255.255.0 crypto map C1 5 ipsec-isakmp crypto map C1 5 match address 110 crypto map C1 5 set peer 212.147.x.1 212.147.x.2 crypto map C1 5 set transform-set set2

The PIX would try 212.147.x.1 first, and if it timed out connecting to 212.147.x.1 at any point, it would move on to 212.147.x.2 -- and it would stick with 212.147.x.2 as long as that still responded before moving back to try 212.147.x.1. That is, if you have multiple peers listed, the PIX does -not- make any attempt to contact the other peers on the list to determine whether they have come up yet and if so then to resume going to them instead of the active peer: it just sticks with whatever peer is active as long as it keeps talking. [However, if the other peer comes alive and contacts the PIX, there are some circumstances under which it can sort of "interrupt" and gain the conversation back again. The documentation on this aspect is confusing.]

You might even be able to combine these last two configurations into something like,

access-list 110 line 1 permit ip 192.168.104.0 255.255.255.0 192.168.105.0

255.255.255.128 access-list 120 line 1 permit ip 192.168.104.0 255.255.255.0 192.168.105.128 255.255.255.128 crypto map C1 5 ipsec-isakmp crypto map C1 5 match address 110 crypto map C1 5 set peer 212.147.x.1 212.147.x.2 crypto map C1 5 set transform-set set2 crypto map C1 10 ipsec-isakmp crypto map C1 10 match address 120 crypto map C1 10 set peer 212.147.x.2 212.147.x.1 crypto map C1 10 set transform-set set2

This would be appropriate for circumstances in which you want to split the traffic while both Nortel are alive, and the Nortel do NOT take on both IPs during failover but -do- somehow assume the ability to take on both subnets, and that the Nortels also know how to shift back to only handling one of the subnets when they come out of failover.

[I have no information as to what the Nortels are able to handle.]