I have been following the Sonicwall and the Cisco guides to establish an IPSec VPN Tunnel between these two devices. When in production, it will be a Cisco Pix 515E, but that is not on my side; this is merely a proof of concept and configuration for the Sonicwall.
I have followed these guides and have successfully established a VPN tunnel between these test sites. However, I cannot get traffic to pass between them.
Site A Device: Pix 501 Outside IP: X.X.X.X Inside IP: 10.10.5.1/24
Site B Device: Sonicwall Pro 4100 Outside IP: Y.Y.Y.Y Inside IP: 192.168.10.50/24
The original goal here is to get traffic from 10.10.5.0/24 to/from
192.168.10.0/24. The VPN is established, but no traffic passes. I am confident that the problem is probably on the Pix side, as I used the wizard on the Sonicwall which automatically established the proper firewall permissions. I have not setup a VPN with a Pix in some time, so I may have missed something obvious, here is the Pix config:PIX Version 6.3(5) interface ethernet0 auto interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password **************** encrypted passwd **************** encrypted hostname pixfirewall domain-name ciscopix.com fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list TUNNEL_ACL permit ip 10.10.5.0 255.255.255.0 192.168.10.0
255.255.255.0 pager lines 24 mtu outside 1500 mtu inside 1500 ip address outside pppoe setroute ip address inside 10.10.5.1 255.255.255.0 ip audit info action alarm ip audit attack action alarm pdm location 10.10.5.2 255.255.255.255 inside pdm logging informational 100 pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list TUNNEL_ACL nat (inside) 1 0.0.0.0 0.0.0.0 0 0 timeout xlate 0:05:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout sip-disconnect 0:02:00 sip-invite 0:03:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local http server enable http 10.10.5.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable sysopt connection permit-ipsec crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto map TUNNEL_MAP 10 ipsec-isakmp crypto map TUNNEL_MAP 10 match address TUNNEL_ACL crypto map TUNNEL_MAP 10 set peer Y.Y.Y.Y crypto map TUNNEL_MAP 10 set transform-set ESP-3DES-SHA crypto map TUNNEL_MAP interface outside isakmp enable outside isakmp key ******** address Y.Y.Y.Y netmask 255.255.255.255 isakmp identity address isakmp policy 10 authentication pre-share isakmp policy 10 encryption 3des isakmp policy 10 hash sha isakmp policy 10 group 2 isakmp policy 10 lifetime 28800 telnet timeout 5 ssh timeout 5 console timeout 0 vpdn group pppoe_group request dialout pppoe vpdn group pppoe_group localname ************************** vpdn group pppoe_group ppp authentication pap vpdn username ************************** password ********* dhcpd address 10.10.5.2-10.10.5.33 inside dhcpd lease 3600 dhcpd ping_timeout 750 dhcpd auto_config outside dhcpd enable inside terminal width 80