Hi all I am sure this is a routing issue as all signs show that the SA's are established and the IPSEC has been established correctly
From my router at home (dummy IP's inserted with 1.1.1.1 being the
office and 2.2.2.2 being my home router)
sh crypto isakmp sa dst src state conn-id slot status
1.1.1.1 2.2.2.2 QM_IDLE 2 0 ACTIVE
sh crypto sess Crypto session current status
Interface: Dialer0 Session status: UP-NO-IKE Peer: 1.1.1.1 port 500 IPSEC FLOW: permit ip 10.10.10.0/255.255.255.0
192.168.200.0/255.255.252.0 Active SAs: 0, origin: crypto map IPSEC FLOW: permit ip 10.10.10.0/255.255.255.0
192.168.1.0/255.255.255.0 Active SAs: 0, origin: crypto map IPSEC FLOW: permit ip 10.10.10.0/255.255.255.0
192.168.26.0/255.255.255.0 Active SAs: 0, origin: crypto map IPSEC FLOW: permit ip 10.10.10.0/255.255.255.0
192.168.100.0/255.255.255.0 Active SAs: 2, origin: crypto map
Interface: Virtual-Access2 Session status: DOWN Peer: 1.1.1.1 port 500 IPSEC FLOW: permit ip 10.10.10.0/255.255.255.0
192.168.200.0/255.255.252.0 Active SAs: 0, origin: crypto map IPSEC FLOW: permit ip 10.10.10.0/255.255.255.0
192.168.1.0/255.255.255.0 Active SAs: 0, origin: crypto map IPSEC FLOW: permit ip 10.10.10.0/255.255.255.0
192.168.26.0/255.255.255.0 Active SAs: 0, origin: crypto map IPSEC FLOW: permit ip 10.10.10.0/255.255.255.0
192.168.100.0/255.255.255.0 Active SAs: 0, origin: crypto map
Interface: Dialer0 Session status: UP-IDLE Peer: 1.1.1.1 port 500 IKE SA: local 2.2.2.2/500 remote 1.1.1.1/500 Active
From the PIX 515E V6.3(4)
sh crypto isakmp sa Total : 1 Embryonic : 0 dst src state pending created 1.1.1.1 2.2.2.2 QM_IDLE 0 1
As shown above it all looks good
On my home router it's just a default route for all traffic out of Dialer0 My home router's LAN interface is 10.10.10.1 /24 The remote subnets are 192.168.26.0/24, 192.168.100.0/24 Access lists are all correct and nat is set to bypass traffic destined between these subnets But for the hell of me I cannot ping either end
More info The 3750 router / switch is set to route 10.10.10.0/24 out
192.168.100.37, the inside i/f of the PIX via a static route The 3750 is running RIP and the 10.0.0.0 network is part of this for other 10.0.0.0 subnets that go out the WAN thru another router (a
2811) Here is the sh route from the PIX
outside 0.0.0.0 0.0.0.0 1.1.1.2 1 OTHER static inside 10.0.0.0 255.255.0.0 10.200.3.18 1 OTHER static outside 10.10.10.0 255.255.255.0 1.1.1.2 1 OTHER static
The config of my router
crypto isakmp policy 20 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key thesharedkey address 2.2.2.2 ! ! crypto ipsec transform-set aff-ts esp-3des esp-md5-hmac ! ! crypto map aff-ho 20 ipsec-isakmp set peer 2.2.2.2 set security-association lifetime seconds 86400 set transform-set aff-ts match address 101
the PIX config
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto map outside_map 20 ipsec-isakmp crypto map outside_map 20 match address outside_cryptomap_20 crypto map outside_map 20 set peer 1.1.1.1 crypto map outside_map 20 set transform-set ESP-3DES-MD5 crypto map outside_map interface outside isakmp enable outside isakmp key ******** address 1.1.1.1 netmask 255.255.255.255 no-xauth no-config-mode isakmp identity address isakmp policy 20 authentication pre-share isakmp policy 20 encryption 3des isakmp policy 20 hash md5 isakmp policy 20 group 2 isakmp policy 20 lifetime 86400
If anyone can offer any assitance it would be most appreciated
Scott