Looks like your NAT ACL is getting in the way... Make it extended and put a deny from 10.0.0.0/24 to 10.1.0.0/24 so that your VPN traffic doesn't get NATted first. i.e.: ip nat inside source list 150 interface FastEthernet0/0 overload access-list 150 deny ip 10.0.0.0 0.0.0.255 10.1.0.0 0.0.0.255 access-list 150 permit ip 10.0.0.0 0.0.0.255 any Cheers, Matt Matt Hill Technical Systems Instructor EXCOM Education Nth Lobby Gnd F 191 Pulteney St | Adelaide | SA | 5000 Tel: +61 8 8232 7706 | Fax: +61 8 8232 7707 Microsoft World Wide Certified Partner Learning Solutions Finalist 2006 | Novell Linux Centre of Excellence (APAC) | Citrix Authorised Learning Centre of the Year 2003 & 2004 (ANZ) This electronic mail/facsimile contains information that is privileged and confidential, intended only for use of the individual(s) named or addresses listed. If you are not the intended recipient, any dissemination, copying or use of the information is strictly prohibited.
________________________________ From: [EMAIL PROTECTED] on behalf of Seth Mattinen Sent: Mon 2/04/2007 09:19 To: [email protected] Subject: [c-nsp] 2621 to SonicWall VPN Trouble I've been having some trouble with a VPN between a 2600 and a SonicWall working. The 2600 has 10.0.0.0/24 behind it, the SonicWall has 10.1.0.0/24 behind it. The 2621 is running c2600-jk8o3s-mz.122-10a.bin and both ends are in DES mode. The VPN appears to come up fine, but no traffic passes. Any ideas? tanager#show crypto map Crypto Map "sonicwalmap" 10 ipsec-isakmp Description: vpn tunnel to sonicwall firewall Peer = 207.228.13.226 Extended IP access list 120 access-list 120 permit ip 10.0.0.0 0.0.0.255 10.1.0.0 0.0.0.255 Current peer: 207.228.13.226 Security association lifetime: 4608000 kilobytes/28800 seconds PFS (Y/N): N Transform sets={ sonicwal, } Interfaces using crypto map sonicwalmap: FastEthernet0/0 tanager#show crypto ipsec sa interface: FastEthernet0/0 Crypto map tag: sonicwalmap, local addr. 68.190.179.54 local ident (addr/mask/prot/port): (10.0.0.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (10.1.0.0/255.255.255.0/0/0) current_peer: 207.228.13.226 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0 #pkts decaps: 6954, #pkts decrypt: 6954, #pkts verify 6954 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0 local crypto endpt.: 68.190.179.54, remote crypto endpt.: 207.228.13.226 path mtu 1500, media mtu 1500 current outbound spi: E2C6A7F1 inbound esp sas: spi: 0x29380156(691536214) transform: esp-des esp-md5-hmac , in use settings ={Tunnel, } slot: 0, conn id: 2002, flow_id: 3, crypto map: sonicwalmap sa timing: remaining key lifetime (k/sec): (4607932/39) IV size: 8 bytes replay detection support: Y spi: 0x28893C27(680082471) transform: esp-des esp-md5-hmac , in use settings ={Tunnel, } slot: 0, conn id: 2004, flow_id: 5, crypto map: sonicwalmap sa timing: remaining key lifetime (k/sec): (4607982/28677) IV size: 8 bytes replay detection support: Y inbound ah sas: inbound pcp sas: outbound esp sas: spi: 0x26A0B2B4(648065716) transform: esp-des esp-md5-hmac , in use settings ={Tunnel, } slot: 0, conn id: 2003, flow_id: 4, crypto map: sonicwalmap sa timing: remaining key lifetime (k/sec): (4608000/39) IV size: 8 bytes replay detection support: Y spi: 0xE2C6A7F1(3804669937) transform: esp-des esp-md5-hmac , in use settings ={Tunnel, } slot: 0, conn id: 2005, flow_id: 6, crypto map: sonicwalmap sa timing: remaining key lifetime (k/sec): (4608000/28674) IV size: 8 bytes replay detection support: Y outbound ah sas: outbound pcp sas: 2621 Config: ! version 12.2 service timestamps debug uptime service timestamps log uptime service password-encryption ! hostname tanager ! aaa new-model enable secret 5 qwertyuiop ! username admin password 7 qwertyuiop ip subnet-zero ! ! ip domain-name tanager.net ! ip audit notify log ip audit po max-events 100 ip ssh authentication-retries 5 ! class-map match-all voice match access-group 104 ! ! policy-map QoS class voice priority 512 ! ! crypto isakmp policy 10 hash md5 authentication pre-share lifetime 28800 crypto isakmp key myfancykey address 207.228.13.226 ! ! crypto ipsec transform-set sonicwal esp-des esp-md5-hmac ! crypto map sonicwalmap 10 ipsec-isakmp description vpn tunnel to sonicwall firewall set peer 207.228.13.226 set security-association lifetime seconds 28800 set transform-set sonicwal match address 120 ! call rsvp-sync ! ! ! ! ! ! ! ! interface FastEthernet0/0 ip address 68.190.179.54 255.255.255.248 ip nat outside speed 100 full-duplex crypto map sonicwalmap ! interface Serial0/0 ip unnumbered FastEthernet0/0 ip nat outside no ip mroute-cache no fair-queue ! interface FastEthernet0/1 no ip address ip route-cache flow duplex auto speed 100 ! interface FastEthernet0/1.1 description main office encapsulation isl 1 ip address 10.0.0.1 255.255.255.0 ip access-group 1 in no ip redirects ip nat inside ! interface FastEthernet0/1.101 description roffice encapsulation isl 101 ip address 10.0.1.1 255.255.255.0 ip helper-address 10.0.0.64 no ip redirects ip nat inside ! interface FastEthernet0/1.103 description phones encapsulation isl 103 ip address 10.0.3.1 255.255.255.0 no ip redirects ! interface FastEthernet0/1.104 description roffice phones encapsulation isl 104 ip address 10.0.4.1 255.255.255.0 no ip redirects ! interface Serial0/1 ip unnumbered FastEthernet0/0 ip nat inside encapsulation ppp no ip mroute-cache service-policy output QoS compress stac service-module t1 clock source internal ! ip nat inside source list 1 interface FastEthernet0/0 overload ip nat inside source static tcp 10.0.0.64 25 interface FastEthernet0/0 25 ip nat inside source static tcp 10.0.0.64 80 interface FastEthernet0/0 80 ip nat inside source static tcp 10.0.0.64 1723 interface FastEthernet0/0 1723 ip nat inside source static tcp 10.0.0.125 3389 interface FastEthernet0/0 3389 ip classless ip route 0.0.0.0 0.0.0.0 68.190.179.49 no ip http server ip pim bidir-enable ! access-list 1 permit 10.0.0.0 0.0.255.255 access-list 104 permit tcp any any eq 3456 access-list 104 permit udp any any eq 3456 access-list 104 permit tcp any any eq 50000 access-list 104 permit udp any any eq 50000 access-list 104 permit tcp any any eq 51216 access-list 104 permit udp any any eq 51216 access-list 104 permit tcp any any range 1025 1039 access-list 104 permit udp any any range 1025 1039 access-list 104 permit tcp any any eq 60000 access-list 104 permit udp any any eq 60000 access-list 104 permit tcp any any eq 60030 access-list 104 permit udp any any eq 60030 access-list 120 permit ip 10.0.0.0 0.0.0.255 10.1.0.0 0.0.0.255 ! -- [EMAIL PROTECTED] Ne cede malis sed contra audentior ito _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
