Hi all, I'm attempting to setup a VPN between 111.111.111.111 (Cisco 827) and 222.222.222.222 (SecurePlatform R55), as well as 111.111.111.111 and 233.233.233.233 (SecurePlatform R55). The CheckPoint end of the VPN works fine (I see encrypt in the logs), but it seems my 827 config isn't allowing the VPN traffic to pass in or out of its ip nat inside. For instance, when I ping from the Cisco 192.168.12.0 to either of the CheckPoint networks, nothing shows up in the logs on the CheckPoint side, and of course nothing makes it through. When I ping from the CheckPoint networks, I see "encrypt" but there are no response to the pings. I'm positive it's a mistake with either a VPN or NAT rule on the Cisco side, since I've never setup an ATM0.X interface with VPNs, but I can't figure out where (I'm CheckPoint person trying out this Cisco stuff). Here is my config:
What should I look at? thanks Chris --- Using 6680 out of 131072 bytes ! ! Last configuration change at 18:31:49 PCTimeZ Thu Feb 19 2004 by sandcrouter ! NVRAM config last updated at 18:31:50 PCTimeZ Thu Feb 19 2004 by sandcrouter ! version 12.2 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone service password-encryption service sequence-numbers ! hostname sandcrouter ! no logging buffered logging console critical enable secret blah ! username sandcrouter privilege 15 password blah clock timezone PCTimeZone -5 ip subnet-zero no ip source-route ip tcp synwait-time 10 ip domain name sandc.example.com ip name-server 151.196.0.38 ip name-server 151.196.0.39 ip dhcp excluded-address 192.168.12.1 192.168.12.49 ip dhcp excluded-address 192.168.12.251 192.168.12.254 ! ip dhcp pool CLIENT network 192.168.12.0 255.255.255.0 default-router 192.168.12.1 dns-server 151.196.0.38 151.196.0.39 lease 0 2 ! no ip bootp server ip cef ip inspect name DEFAULT100 cuseeme ip inspect name DEFAULT100 ftp ip inspect name DEFAULT100 h323 ip inspect name DEFAULT100 netshow ip inspect name DEFAULT100 rcmd ip inspect name DEFAULT100 sqlnet ip inspect name DEFAULT100 streamworks ip inspect name DEFAULT100 tftp ip inspect name DEFAULT100 tcp ip inspect name DEFAULT100 udp ip inspect name DEFAULT100 vdolive ip inspect name DEFAULT100 icmp ip inspect name DEFAULT100 realaudio ip inspect name DEFAULT100 rtsp ip inspect name DEFAULT100 smtp ip urlfilter alert ip ssh time-out 60 ip ssh authentication-retries 2 ! ! ! crypto isakmp policy 1 encr 3des authentication pre-share group 5 ! crypto isakmp key sandcrt5678 address 222.222.222.222 crypto isakmp key sandcrt5678 address 233.233.233.233 crypto isakmp keepalive 60 10 ! ! crypto ipsec transform-set SDM_TRANSFORMSET_1 esp-3des esp-sha-hmac crypto ipsec transform-set SDM_TRANSFORMSET_2 esp-3des esp-sha-hmac ! crypto map SDM_CMAP_1 1 ipsec-isakmp description Tunnel to 222.222.222.222 set peer 222.222.222.222 set transform-set SDM_TRANSFORMSET_1 set pfs group5 match address 100 crypto map SDM_CMAP_1 2 ipsec-isakmp description Tunnel to 233.233.233.233 set peer 233.233.233.233 set transform-set SDM_TRANSFORMSET_2 set pfs group5 match address 102 ! ! ! ! interface Ethernet0 description LAN ip address 192.168.12.1 255.255.255.0 ip access-group 103 in no ip redirects no ip unreachables no ip proxy-arp ip nat inside ip route-cache flow no ip mroute-cache no cdp enable hold-queue 100 out ! interface ATM0 no ip address no atm ilmi-keepalive dsl operating-mode auto dsl power-cutback 0 ! interface ATM0.1 point-to-point description WAN ip address 111.111.111.111 255.255.255.0 ip access-group 104 in ip verify unicast reverse-path no ip redirects no ip unreachables no ip proxy-arp ip nat outside ip inspect DEFAULT100 out pvc 0/35 protocol ip 111.111.111.1 ! crypto map SDM_CMAP_1 ! ip nat inside source list 1 interface ATM0.1 overload ip classless ip route 0.0.0.0 0.0.0.0 ATM0.1 ip http server no ip http secure-server ! ! access-list 1 permit 192.168.12.0 0.0.0.255 access-list 1 remark INSIDE_IF=Ethernet0 access-list 1 remark SDM_ACL Category=2 access-list 100 remark SDM_ACL Category=4 access-list 100 remark IPSec Rule access-list 100 permit ip 192.168.12.0 0.0.0.255 192.168.6.0 0.0.0.255 access-list 101 remark SDM_ACL Category=2 access-list 101 remark IPSec Rule access-list 101 deny ip 192.168.12.0 0.0.0.255 192.168.2.0 0.0.0.255 access-list 101 deny ip 192.168.12.0 0.0.0.255 192.168.6.0 0.0.0.255 access-list 101 permit ip 192.168.12.0 0.0.0.255 any access-list 102 remark SDM_ACL Category=4 access-list 102 remark IPSec Rule access-list 102 permit ip 192.168.12.0 0.0.0.255 192.168.2.0 0.0.0.255 access-list 103 remark auto generated by SDM firewall configuration access-list 103 remark SDM_ACL Category=1 access-list 103 deny ip 68.236.167.0 0.0.0.255 any access-list 103 deny ip host 255.255.255.255 any access-list 103 deny ip 127.0.0.0 0.255.255.255 any access-list 103 permit ip any any access-list 104 remark auto generated by SDM firewall configuration access-list 104 remark SDM_ACL Category=1 access-list 104 remark Auto generated by SDM for NTP (123) 192.5.41.40 access-list 104 permit udp host 192.5.41.40 eq ntp host 111.111.111.111 eq ntp access-list 104 remark Auto generated by SDM for NTP (123) 192.5.41.41 access-list 104 permit udp host 192.5.41.41 eq ntp host 111.111.111.111 eq ntp access-list 104 permit ahp host 233.233.233.233 host 111.111.111.111 access-list 104 permit esp host 233.233.233.233 host 111.111.111.111 access-list 104 permit udp host 233.233.233.233 host 111.111.111.111 eq isakmp access-list 104 permit udp host 233.233.233.233 host 111.111.111.111 eq non500-isakmp access-list 104 remark IPSec Rule access-list 104 permit ip 192.168.2.0 0.0.0.255 192.168.12.0 0.0.0.255 access-list 104 permit ahp host 222.222.222.222 host 111.111.111.111 access-list 104 permit esp host 222.222.222.222 host 111.111.111.111 access-list 104 permit udp host 222.222.222.222 host 111.111.111.111 eq isakmp access-list 104 permit udp host 222.222.222.222 host 111.111.111.111 eq non500-isakmp access-list 104 permit ip 192.168.6.0 0.0.0.255 192.168.12.0 0.0.0.255 access-list 104 deny ip 192.168.12.0 0.0.0.255 any access-list 104 permit icmp any host 111.111.111.111 echo-reply access-list 104 permit icmp any host 111.111.111.111 echo access-list 104 permit icmp any host 111.111.111.111 time-exceeded access-list 104 permit icmp any host 111.111.111.111 unreachable access-list 104 deny ip 10.0.0.0 0.255.255.255 any access-list 104 deny ip 172.16.0.0 0.15.255.255 any access-list 104 deny ip 192.168.0.0 0.0.255.255 any access-list 104 deny ip 127.0.0.0 0.255.255.255 any access-list 104 deny ip host 255.255.255.255 any access-list 104 deny ip host 0.0.0.0 any access-list 104 deny ip any any log no cdp run ! route-map SDM_RMAP_1 permit 1 match ip address 101 ! banner login ^CAuthorized access only! Disconnect IMMEDIATELY if you are not an authorized user!^C ! line con 0 exec-timeout 120 0 login local transport output telnet stopbits 1 line vty 0 4 exec-timeout 120 0 privilege level 15 login local length 0 transport input telnet ssh ! scheduler max-task-time 5000 scheduler interval 500 sntp server 192.5.41.41 sntp server 192.5.41.40 end ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
