TESTLAB:
In the test situation the complete flow was working from the beginning to the end
PC - LAN -- Cisco PIX 515 (INTERNET) Symantec Firewall 5420 Cluster - LAN - SERVER
Finally this combination is placed at the customer site. SA has been created but there is no traffic possible through the IPsec VPN tunnel anymore. The only thing which has been change is the outside IP address of the Cisco PIX and the Cisco PIX is now behind a Check Point firewall.
Port UDP 500 is open and also IP type 50 (ESP)
REAL SITUATION:
LAN(s) -- Cisco PIX 515 --Checkpoint FW-- (INTERNET) Symantec Firewall 5420 Cluster - LAN - SERVER
What goes wrong, is there some one who can help me
Kind regards
Megane
The config and access-list below;
test-fwl01# sh isa sa Total : 1 Embryonic : 0 dst src state pending created xxx.yyy.252.124 aaa.bb.214.64 QM_IDLE 0 1
test-fwl01# wr t Building configuration... : Saved : PIX Version 6.3(3) interface ethernet0 auto interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password removed passwd removed encrypted hostname test-fwl01 domain-name test.com clock timezone CEST 1 clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00 fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list acl_inbound permit icmp any any echo-reply log access-list acl_inbound permit icmp any any echo access-list acl_outbound permit ip aaa.bb.0.0 255.255.0.0 any access-list acl_outbound permit ip aaa.bb.213.0 255.255.255.224 any access-list acl_outbound permit ip ccc.ddd.214.0 255.255.254.0 any access-list acl_outbound permit ip ccc.ddd.216.0 255.255.252.0 any access-list acl_outbound permit ip eee.fff.192.0 255.255.224.0 any access-list nonat permit ip aaa.bb.0.0 255.255.0.0 10.32.1.128
255.255.255.128 access-list nonat permit ip aaa.bb.213.0 255.255.255.224 10.32.1.128 255.255.255.128 access-list nonat permit ip ccc.ddd.214.0 255.255.254.0 10.32.1.128 255.255.255.128 access-list nonat permit ip ccc.ddd.216.0 255.255.252.0 10.32.1.128 255.255.255.128 access-list nonat permit ip eee.fff.192.0 255.255.224.0 10.32.1.128 255.255.255.128 access-list IPsec_TUNNEL permit ip aaa.bb.0.0 255.255.0.0 host 10.32.1.129 access-list IPsec_TUNNEL permit ip aaa.bb.0.0 255.255.0.0 host 10.32.1.130 access-list IPsec_TUNNEL permit ip aaa.bb.0.0 255.255.0.0 host 10.32.1.131 access-list IPsec_TUNNEL permit ip ccc.ddd.214.0 255.255.254.0 host 10.32.1.129 access-list IPsec_TUNNEL permit ip ccc.ddd.214.0 255.255.254.0 host 10.32.1.130 access-list IPsec_TUNNEL permit ip ccc.ddd.214.0 255.255.254.0 host 10.32.1.131 access-list IPsec_TUNNEL permit ip ccc.ddd.216.0 255.255.252.0 host 10.32.1.129 access-list IPsec_TUNNEL permit ip ccc.ddd.216.0 255.255.252.0 host 10.32.1.130 access-list IPsec_TUNNEL permit ip ccc.ddd.216.0 255.255.252.0 host 10.32.1.131 access-list IPsec_TUNNEL permit ip eee.fff.192.0 255.255.224.0 host 10.32.1.129 access-list IPsec_TUNNEL permit ip eee.fff.192.0 255.255.224.0 host 10.32.1.130 access-list IPsec_TUNNEL permit ip eee.fff.192.0 255.255.224.0 host 10.32.1.131 pager lines 24 logging on logging timestamp logging buffered informational logging trap informational logging history notifications mtu outside 1500 mtu inside 1500 ip address outside aaa.bb.214.64 255.255.255.0 ip address inside aaa.bb.213.15 255.255.255.224 ip audit info action alarm ip audit attack action alarm pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list nonat nat (inside) 1 0.0.0.0 0.0.0.0 0 0 access-group acl_inbound in interface outside access-group acl_outbound in interface inside route outside 0.0.0.0 0.0.0.0 aaa.bb.214.254 1 route inside aaa.bb.0.0 255.255.0.0 aaa.bb.213.30 1 route inside ccc.ddd.214.0 255.255.254.0 aaa.bb.213.30 1 route inside ccc.ddd.216.0 255.255.252.0 aaa.bb.213.30 1 route inside eee.fff.192.0 255.255.224.0 aaa.bb.213.30 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius aaa-server LOCAL protocol local no snmp-server location no snmp-server contact snmp-server community SnmpRemoved no snmp-server enable traps floodguard enablesysopt connection permit-ipsec crypto ipsec transform-set PS-SOFT esp-des esp-md5-hmac crypto map pix2sef 1 ipsec-isakmp crypto map pix2sef 1 match address IPsec_TUNNEL crypto map pix2sef 1 set pfs crypto map pix2sef 1 set peer xxx.yyy.252.124 crypto map pix2sef 1 set transform-set PS-SOFT crypto map pix2sef interface outside
isakmp enable outside isakmp key ******** address xxx.yyy.252.124 netmask 255.255.255.255 isakmp identity address isakmp nat-traversal 20 isakmp policy 8 authentication pre-share isakmp policy 8 encryption des isakmp policy 8 hash md5 isakmp policy 8 group 2 isakmp policy 8 lifetime 86400
telnet timeout 5
ssh qq.rrr.26.22 255.255.255.255 outside ssh xxx.yyy.252.124 255.255.255.255 outside ssh aaa.bb.0.0 255.255.0.0 inside
ssh timeout 60 console timeout 0 terminal width 80 Cryptochecksum:977e8138c50fd3c71e004ffa8bc25601 : end [OK]
test-fwl01# test-fwl01# test-fwl01# sh isa sa Total : 1 Embryonic : 0 dst src state pending created xxx.yyy.252.124 aaa.bb.214.64 QM_IDLE 0 1
test-fwl01# test-fwl01# sh access-list access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 1024) alert-interval 300 access-list acl_inbound; 2 elements access-list acl_inbound line 1 permit icmp any any echo-reply log 6 interval
300 (hitcnt=0) access-list acl_inbound line 2 permit icmp any any echo (hitcnt=0) access-list acl_outbound; 5 elements access-list acl_outbound line 1 permit ip aaa.bb.0.0 255.255.0.0 any (hitcnt=0) access-list acl_outbound line 2 permit ip aaa.bb.213.0 255.255.255.224 any (hitcnt=0) access-list acl_outbound line 3 permit ip ccc.ddd.214.0 255.255.254.0 any (hitcnt=0) access-list acl_outbound line 4 permit ip ccc.ddd.216.0 255.255.252.0 any (hitcnt=0) access-list acl_outbound line 5 permit ip eee.fff.192.0 255.255.224.0 any (hitcnt=1369) access-list nonat; 5 elements access-list nonat line 1 permit ip aaa.bb.0.0 255.255.0.0 10.32.1.128 255.255.255.128 (hitcnt=0) access-list nonat line 2 permit ip aaa.bb.213.0 255.255.255.224 10.32.1.128 255.255.255.128 (hitcnt=0) access-list nonat line 3 permit ip ccc.ddd.214.0 255.255.254.0 10.32.1.128 255.255.255.128 (hitcnt=0) access-list nonat line 4 permit ip ccc.ddd.216.0 255.255.252.0 10.32.1.128 255.255.255.128 (hitcnt=0) access-list nonat line 5 permit ip eee.fff.192.0 255.255.224.0 10.32.1.128 255.255.255.128 (hitcnt=935) access-list IPsec_TUNNEL; 12 elements access-list IPsec_TUNNEL line 1 permit ip aaa.bb.0.0 255.255.0.0 host 10.32.1.129 (hitcnt=0) access-list IPsec_TUNNEL line 2 permit ip aaa.bb.0.0 255.255.0.0 host 10.32.1.130 (hitcnt=0) access-list IPsec_TUNNEL line 3 permit ip aaa.bb.0.0 255.255.0.0 host 10.32.1.131 (hitcnt=0) access-list IPsec_TUNNEL line 4 permit ip ccc.ddd.214.0 255.255.254.0 host 10.32.1.129 (hitcnt=0) access-list IPsec_TUNNEL line 5 permit ip ccc.ddd.214.0 255.255.254.0 host 10.32.1.130 (hitcnt=0) access-list IPsec_TUNNEL line 6 permit ip ccc.ddd.214.0 255.255.254.0 host 10.32.1.131 (hitcnt=0) access-list IPsec_TUNNEL line 7 permit ip ccc.ddd.216.0 255.255.252.0 host 10.32.1.129 (hitcnt=0) access-list IPsec_TUNNEL line 8 permit ip ccc.ddd.216.0 255.255.252.0 host 10.32.1.130 (hitcnt=0) access-list IPsec_TUNNEL line 9 permit ip ccc.ddd.216.0 255.255.252.0 host 10.32.1.131 (hitcnt=0) access-list IPsec_TUNNEL line 10 permit ip eee.fff.192.0 255.255.224.0 host 10.32.1.129 (hitcnt=0) access-list IPsec_TUNNEL line 11 permit ip eee.fff.192.0 255.255.224.0 host 10.32.1.130 (hitcnt=0) access-list IPsec_TUNNEL line 12 permit ip eee.fff.192.0 255.255.224.0 host 10.32.1.131 (hitcnt=1441) test-fwl01# test-fwl01# test-fwl01# test-fwl01# test-fwl01#test-fwl01# sh crypto map
Crypto Map: "pix2sef" interfaces: { outside }
Crypto Map "pix2sef" 1 ipsec-isakmp Peer = xxx.yyy.252.124 access-list IPsec_TUNNEL; 12 elements access-list IPsec_TUNNEL line 1 permit ip aaa.bb.0.0 255.255.0.0 host 10.32.1.129 (hitcnt=0) access-list IPsec_TUNNEL line 2 permit ip aaa.bb.0.0 255.255.0.0 host 10.32.1.130 (hitcnt=0) access-list IPsec_TUNNEL line 3 permit ip aaa.bb.0.0 255.255.0.0 host 10.32.1.131 (hitcnt=0) access-list IPsec_TUNNEL line 4 permit ip ccc.ddd.214.0
255.255.254.0 host 10.32.1.129 (hitcnt=0) access-list IPsec_TUNNEL line 5 permit ip ccc.ddd.214.0 255.255.254.0 host 10.32.1.130 (hitcnt=0) access-list IPsec_TUNNEL line 6 permit ip ccc.ddd.214.0 255.255.254.0 host 10.32.1.131 (hitcnt=0) access-list IPsec_TUNNEL line 7 permit ip ccc.ddd.216.0 255.255.252.0 host 10.32.1.129 (hitcnt=0) access-list IPsec_TUNNEL line 8 permit ip ccc.ddd.216.0 255.255.252.0 host 10.32.1.130 (hitcnt=0) access-list IPsec_TUNNEL line 9 permit ip ccc.ddd.216.0 255.255.252.0 host 10.32.1.131 (hitcnt=0) access-list IPsec_TUNNEL line 10 permit ip eee.fff.192.0 255.255.224.0 host 10.32.1.129 (hitcnt=0) access-list IPsec_TUNNEL line 11 permit ip eee.fff.192.0 255.255.224.0 host 10.32.1.130 (hitcnt=0) access-list IPsec_TUNNEL line 12 permit ip eee.fff.192.0 255.255.224.0 host 10.32.1.131 (hitcnt=1441) Current peer: xxx.yyy.252.124 Security association lifetime: 4608000 kilobytes/28800 seconds PFS (Y/N): Y DH group: group1 Transform sets={ PS-SOFT, } test-fwl01# sh crypto sainterface: outside Crypto map tag: pix2sef, local addr. aaa.bb.214.64
local ident (addr/mask/prot/port): (eee.fff.192.0/255.255.224.0/0/0) remote ident (addr/mask/prot/port): (10.32.1.129/255.255.255.255/0/0) current_peer: xxx.yyy.252.124:0 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0
local crypto endpt.: aaa.bb.214.64, remote crypto endpt.: xxx.yyy.252.124 path mtu 1500, ipsec overhead 0, media mtu 1500 current outbound spi: 0
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
local ident (addr/mask/prot/port): (eee.fff.192.0/255.255.224.0/0/0) remote ident (addr/mask/prot/port): (10.32.1.130/255.255.255.255/0/0) current_peer: xxx.yyy.252.124:0 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0
local crypto endpt.: aaa.bb.214.64, remote crypto endpt.: xxx.yyy.252.124 path mtu 1500, ipsec overhead 0, media mtu 1500 current outbound spi: 0
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
local ident (addr/mask/prot/port): (eee.fff.192.0/255.255.224.0/0/0) remote ident (addr/mask/prot/port): (10.32.1.131/255.255.255.255/0/0) current_peer: xxx.yyy.252.124:500 PERMIT, flags={origin_is_acl,} #pkts encaps: 1444, #pkts encrypt: 1444, #pkts digest 1444 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0 #send errors 1, #recv errors 0
local crypto endpt.: aaa.bb.214.64, remote crypto endpt.: xxx.yyy.252.124 path mtu 1500, ipsec overhead 56, media mtu 1500 current outbound spi: d236f66e
inbound esp sas: spi: 0x91a8a520(2443748640) transform: esp-des esp-md5-hmac , in use settings ={Tunnel, } slot: 0, conn id: 1, crypto map: pix2sef sa timing: remaining key lifetime (k/sec): (4608000/16617) IV size: 8 bytes replay detection support: Y
inbound ah sas:
inbound pcp sas:
outbound esp sas: spi: 0xd236f66e(3526817390) transform: esp-des esp-md5-hmac , in use settings ={Tunnel, } slot: 0, conn id: 2, crypto map: pix2sef sa timing: remaining key lifetime (k/sec): (4607915/16617) IV size: 8 bytes replay detection support: Y
outbound ah sas:
outbound pcp sas:
local ident (addr/mask/prot/port): (ccc.ddd.214.0/255.255.254.0/0/0) remote ident (addr/mask/prot/port): (10.32.1.129/255.255.255.255/0/0) current_peer: xxx.yyy.252.124:0 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0
local crypto endpt.: aaa.bb.214.64, remote crypto endpt.: xxx.yyy.252.124 path mtu 1500, ipsec overhead 0, media mtu 1500 current outbound spi: 0
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
local ident (addr/mask/prot/port): (ccc.ddd.214.0/255.255.254.0/0/0) remote ident (addr/mask/prot/port): (10.32.1.130/255.255.255.255/0/0) current_peer: xxx.yyy.252.124:0 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0
local crypto endpt.: aaa.bb.214.64, remote crypto endpt.: xxx.yyy.252.124 path mtu 1500, ipsec overhead 0, media mtu 1500 current outbound spi: 0
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
local ident (addr/mask/prot/port): (ccc.ddd.216.0/255.255.252.0/0/0) remote ident (addr/mask/prot/port): (10.32.1.129/255.255.255.255/0/0) current_peer: xxx.yyy.252.124:0 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0
local crypto endpt.: aaa.bb.214.64, remote crypto endpt.: xxx.yyy.252.124 path mtu 1500, ipsec overhead 0, media mtu 1500 current outbound spi: 0
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
local ident (addr/mask/prot/port): (ccc.ddd.214.0/255.255.254.0/0/0) remote ident (addr/mask/prot/port): (10.32.1.131/255.255.255.255/0/0) current_peer: xxx.yyy.252.124:0 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0
local crypto endpt.: aaa.bb.214.64, remote crypto endpt.: xxx.yyy.252.124 path mtu 1500, ipsec overhead 0, media mtu 1500 current outbound spi: 0
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
local ident (addr/mask/prot/port): (ccc.ddd.216.0/255.255.252.0/0/0) remote ident (addr/mask/prot/port): (10.32.1.130/255.255.255.255/0/0) current_peer: xxx.yyy.252.124:0 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0
local crypto endpt.: aaa.bb.214.64, remote crypto endpt.: xxx.yyy.252.124 path mtu 1500, ipsec overhead 0, media mtu 1500 current outbound spi: 0
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
local ident (addr/mask/prot/port): (ccc.ddd.216.0/255.255.252.0/0/0) remote ident (addr/mask/prot/port): (10.32.1.131/255.255.255.255/0/0) current_peer: xxx.yyy.252.124:0 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0
local crypto endpt.: aaa.bb.214.64, remote crypto endpt.: xxx.yyy.252.124 path mtu 1500, ipsec overhead 0, media mtu 1500 current outbound spi: 0
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
local ident (addr/mask/prot/port): (aaa.bb.0.0/255.255.0.0/0/0) remote ident (addr/mask/prot/port): (10.32.1.129/255.255.255.255/0/0) current_peer: xxx.yyy.252.124:0 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0
local crypto endpt.: aaa.bb.214.64, remote crypto endpt.: xxx.yyy.252.124 path mtu 1500, ipsec overhead 0, media mtu 1500 current outbound spi: 0
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
local ident (addr/mask/prot/port): (aaa.bb.0.0/255.255.0.0/0/0) remote ident (addr/mask/prot/port): (10.32.1.130/255.255.255.255/0/0) current_peer: xxx.yyy.252.124:0 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0
local crypto endpt.: aaa.bb.214.64, remote crypto endpt.: xxx.yyy.252.124 path mtu 1500, ipsec overhead 0, media mtu 1500 current outbound spi: 0
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
local ident (addr/mask/prot/port): (aaa.bb.0.0/255.255.0.0/0/0) remote ident (addr/mask/prot/port): (10.32.1.131/255.255.255.255/0/0) current_peer: xxx.yyy.252.124:0 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0
local crypto endpt.: aaa.bb.214.64, remote crypto endpt.: xxx.yyy.252.124 path mtu 1500, ipsec overhead 0, media mtu 1500 current outbound spi: 0
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas: