Folks, Thanks for your comments. I am able to fix the issue. As you all guessed the switch trunk configuration wasn't correct (section: 2.1 d). I put the config and reloaded switch-1. It all worked! -Anshul
________________________________ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mehmood Sajid Sent: Thursday, December 27, 2007 4:12 AM To: [email protected] Subject: Re: [OSL | CCIE_Security] CCIE_Security Digest, Vol 18, Issue 10 Check out switch trunk config where PIX interface is terminated and make sure your PIX interface is up, same with VPNC public interface if you can dump PIX and Switch config that will helps to trace the problem. not an issue to ping from PIX to VPNC public interface. as per your configuration below. Regards, Mehmood Sajid ________________________________ > From: [EMAIL PROTECTED] > Subject: CCIE_Security Digest, Vol 18, Issue 10 > To: [email protected] > Date: Wed, 26 Dec 2007 12:00:03 -0500 > > Send CCIE_Security mailing list submissions to > [email protected] > > To subscribe or unsubscribe via the World Wide Web, visit > http://onlinestudylist.com/mailman/listinfo/ccie_security > or, via email, send a message with subject or body 'help' to > [EMAIL PROTECTED] > > You can reach the person managing the list at > [EMAIL PROTECTED] > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of CCIE_Security digest..." > > > Today's Topics: > > 1. Section 15: Task 7.1 (d): Basic concentrator configuration > (Anshul Arora (akarora)) > 2. Re: Section 15: Task 7.1 (d): Basic concentrator > configuration ([EMAIL PROTECTED]) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 25 Dec 2007 18:56:41 -0800 > From: "Anshul Arora (akarora)" <[EMAIL PROTECTED]> > Subject: [OSL | CCIE_Security] Section 15: Task 7.1 (d): Basic > concentrator configuration > To: <[email protected]> > Message-ID: > <[EMAIL PROTECTED]> > Content-Type: text/plain; charset="us-ascii" > > Hi All, > > I've got VPN Concentrator configured with Private, Public, default GW as > displayed below. > > Intf Status IP Address/Subnet Mask MAC > Address > ------------------------------------------------------------------------ > ------- > Ether1-Pri| UP | 10.2.2.5/255.255.255.0 | > 00.03.A0.8A.D7.A4 > Ether2-Pub| UP | 192.168.5.5/255.255.255.0 | > 00.03.A0.8A.D7.A5 > ------------------------------------------------------------------------ > ------- > DNS Server(s): DNS Server Not Configured > DNS Domain Name: > Default Gateway: 192.168.5.10 > > Problem: > PIX logical int Ethernet0.55 (192.168.5.10) can't ping 192.168.5.5. Due > to this, management PC (10.1.1.100) isn't reaching VPNC. But VPNC is > able to ping R1 & PC from 10.2.2.5 (Private). > > Tasks executed: > R1 static route : ip route 192.168.5.0 255.255.255.0 10.2.2.10 > PIX NAT : global (DMZ55) 1 interface > VPNC disabled RIP on inbound. > PC: route add 192.168.5.0 mask 255.255.255.0 10.1.1.1 > > What else do I need to add in PIX so that VPNC can ping PIX from its > public interface? Relevant PIX config is also attached herewith...just > incase. > > Appreciate any help. > -Anshul > > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: http://onlinestudylist.com/pipermail/ccie_security/attachments/20071225/ 5312df63/attachment-0001.html > -------------- next part -------------- > An embedded and charset-unspecified text was scrubbed... > Name: PIX-config.txt > Url: http://onlinestudylist.com/pipermail/ccie_security/attachments/20071225/ 5312df63/PIX-config-0001.txt > > ------------------------------ > > Message: 2 > Date: Wed, 26 Dec 2007 00:41:11 -0500 > From: <[EMAIL PROTECTED]> > Subject: Re: [OSL | CCIE_Security] Section 15: Task 7.1 (d): Basic > concentrator configuration > To: "'Anshul Arora \(akarora\)'" <[EMAIL PROTECTED]>, > <[email protected]> > Message-ID: <[EMAIL PROTECTED]> > Content-Type: text/plain; charset="us-ascii" > > If your devices are on the same VLAN, it would seem like you have an issue > with traffic on that Vlan. > > > > My first guess would be that your switchport from the switch to the pix is > not correctly configured to allow the traffic on vlan 55. (section 2.1d) > > > > Add an IP address on Cat1 and Cat2 in VLAN 55. > > > > 1. On Cat1, ping the address of Cat2's VLAN 55 address (this will check > inter-switch traffic for VLAN 55) > > > > 2. On Cat1, ping the address of the concentrator public. (this will test > communication on VLAN 55 for Cat1) > > > > 3. On Cat2, ping the address of the PIX DMZ interface. (this will test > communication on VLAN 55 for Cat2) > > > > > > If #1 above fails, double check your spanning tree config, and make sure > that your VLANs/VTP domain/VTP password are consistent across your switches. > > If #2 fails, double check the vlan assignment on the switchport connecting > to the concentrator > > > > If #3 fails, double check the configuration on the switch for your PIX port. > The switch needs to be configured to allow dot1q tagged traffic on vlan 55 > for that port. > > > > Marvin Greenlee, CCIE #12237 (R&S, SP, Sec) > Senior Technical Instructor - IPexpert, Inc. > A Cisco Learning Partner - We Accept Learning Credits! > Telephone: +1.810.326.1444 > Fax: +1.810.454.0130 > > Mailto: [EMAIL PROTECTED] > > > > IPexpert - The Global Leader in Self-Study, Classroom-Based, Video On Demand > and Audio Certification Training Tools for the Cisco CCIE R&S Lab, CCIE > Security Lab, CCIE Service Provider Lab, CCIE Voice Lab and CCIE Storage Lab > Certifications. > > _____ > > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Anshul Arora > (akarora) > Sent: Tuesday, December 25, 2007 9:57 PM > To: [email protected] > Subject: [OSL | CCIE_Security] Section 15: Task 7.1 (d): Basic concentrator > configuration > > > > Hi All, > > > > I've got VPN Concentrator configured with Private, Public, default GW as > displayed below. > > > > Intf Status IP Address/Subnet Mask MAC Address > ------------------------------------------------------------------------ ---- > --- > Ether1-Pri| UP | 10.2.2.5/255.255.255.0 | > 00.03.A0.8A.D7.A4 > Ether2-Pub| UP | 192.168.5.5/255.255.255.0 | > 00.03.A0.8A.D7.A5 > ------------------------------------------------------------------------ ---- > --- > DNS Server(s): DNS Server Not Configured > DNS Domain Name: > Default Gateway: 192.168.5.10 > > > > Problem: > > PIX logical int Ethernet0.55 (192.168.5.10) can't ping 192.168.5.5. Due to > this, management PC (10.1.1.100) isn't reaching VPNC. But VPNC is able to > ping R1 & PC from 10.2.2.5 (Private). > > > > Tasks executed: > > R1 static route : ip route 192.168.5.0 255.255.255.0 10.2.2.10 > > PIX NAT : global (DMZ55) 1 interface > > VPNC disabled RIP on inbound. > > PC: route add 192.168.5.0 mask 255.255.255.0 10.1.1.1 > > > > What else do I need to add in PIX so that VPNC can ping PIX from its public > interface? Relevant PIX config is also attached herewith...just incase. > > > > Appreciate any help. > > -Anshul > > > > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: http://onlinestudylist.com/pipermail/ccie_security/attachments/20071226/ 74f4c605/attachment-0001.html > > End of CCIE_Security Digest, Vol 18, Issue 10 > ********************************************* ________________________________ Express yourself instantly with MSN Messenger! MSN Messenger <http://clk.atdmt.com/AVE/go/onm00200471ave/direct/01/>
