If your devices are on the same VLAN, it would seem like you have an issue with traffic on that Vlan.
My first guess would be that your switchport from the switch to the pix is not correctly configured to allow the traffic on vlan 55. (section 2.1d) Add an IP address on Cat1 and Cat2 in VLAN 55. 1. On Cat1, ping the address of Cat2's VLAN 55 address (this will check inter-switch traffic for VLAN 55) 2. On Cat1, ping the address of the concentrator public. (this will test communication on VLAN 55 for Cat1) 3. On Cat2, ping the address of the PIX DMZ interface. (this will test communication on VLAN 55 for Cat2) If #1 above fails, double check your spanning tree config, and make sure that your VLANs/VTP domain/VTP password are consistent across your switches. If #2 fails, double check the vlan assignment on the switchport connecting to the concentrator If #3 fails, double check the configuration on the switch for your PIX port. The switch needs to be configured to allow dot1q tagged traffic on vlan 55 for that port. Marvin Greenlee, CCIE #12237 (R&S, SP, Sec) Senior Technical Instructor - IPexpert, Inc. A Cisco Learning Partner - We Accept Learning Credits! Telephone: +1.810.326.1444 Fax: +1.810.454.0130 Mailto: [EMAIL PROTECTED] IPexpert - The Global Leader in Self-Study, Classroom-Based, Video On Demand and Audio Certification Training Tools for the Cisco CCIE R&S Lab, CCIE Security Lab, CCIE Service Provider Lab, CCIE Voice Lab and CCIE Storage Lab Certifications. _____ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Anshul Arora (akarora) Sent: Tuesday, December 25, 2007 9:57 PM To: [email protected] Subject: [OSL | CCIE_Security] Section 15: Task 7.1 (d): Basic concentrator configuration Hi All, I've got VPN Concentrator configured with Private, Public, default GW as displayed below. Intf Status IP Address/Subnet Mask MAC Address ---------------------------------------------------------------------------- --- Ether1-Pri| UP | 10.2.2.5/255.255.255.0 | 00.03.A0.8A.D7.A4 Ether2-Pub| UP | 192.168.5.5/255.255.255.0 | 00.03.A0.8A.D7.A5 ---------------------------------------------------------------------------- --- DNS Server(s): DNS Server Not Configured DNS Domain Name: Default Gateway: 192.168.5.10 Problem: PIX logical int Ethernet0.55 (192.168.5.10) can't ping 192.168.5.5. Due to this, management PC (10.1.1.100) isn't reaching VPNC. But VPNC is able to ping R1 & PC from 10.2.2.5 (Private). Tasks executed: R1 static route : ip route 192.168.5.0 255.255.255.0 10.2.2.10 PIX NAT : global (DMZ55) 1 interface VPNC disabled RIP on inbound. PC: route add 192.168.5.0 mask 255.255.255.0 10.1.1.1 What else do I need to add in PIX so that VPNC can ping PIX from its public interface? Relevant PIX config is also attached herewith...just incase. Appreciate any help. -Anshul
