[ previous ] [ next ] [ threads ]
 
 From:  Kyle McBride <kyle dot mcbride at instatservices dot com>
 Cc:  m0n0wall at lists dot m0n0 dot ch
 Subject:  Re: [m0n0wall] m0n0wall-to-PIX IPsec Issue: specific host(s) as remote subnet?
 Date:  Fri, 13 Oct 2006 09:53:55 -0700
Had the PIX side changed to 172.31.0.0/21 to 192.168.87.0/24 in his acl instead of 
the three specific hosts.  Tunnel came right up.

I guess the answer to my question is "no" - not supported.

Kyle McBride wrote:
> Greetings,
> 
> Need some assistance on m0n0wall to PIX IPSec issue. Cisco guy gave me the
> following as his setup, not a subnet specified in his ACL but 3 specific
> hosts. The 192.168.87.0/24 is my local subnet on m0n0wall side (below
> 1.1.1.1 is m0n0wall public IP and 2.2.2.2 is PIX public IP):
> 
> access-list nonat extended permit ip host 172.31.0.1 192.168.87.0
> 255.255.255.0
> access-list nonat extended permit ip host 172.31.0.80 192.168.87.0
> 255.255.255.0
> access-list nonat extended permit ip host 172.31.1.90 192.168.87.0
> 255.255.255.0
> 
> access-list 600 extended permit ip host 172.31.0.1 192.168.87.0
> 255.255.255.0
> access-list 600 extended permit ip host 172.31.0.80 192.168.87.0
> 255.255.255.0
> access-list 600 extended permit ip host 172.31.1.90 192.168.87.0
> 255.255.255.0
> 
> tunnel-group 1.1.1.1 type ipsec-l2l
> tunnel-group 1.1.1.1 ipsec-attributes
>  pre-shared-key **************
> 
> crypto map newmap 600 match address 600
> crypto map newmap 600 set peer 1.1.1.1
> crypto map newmap 600 set transform-set ESP-3DES-MD5
> 
> 
> Here is the log from m0n0wall.
> 
> Oct 12 09:59:03 racoon: INFO: IPsec-SA request for 216.118.82.254 queued due
> to no phase1 found. 
> Oct 12 09:59:03 racoon: INFO: initiate new phase 1 negotiation:
> 1.1.1.1[500]<=>2.2.2.2[500] 
> Oct 12 09:59:03 racoon: INFO: begin Aggressive mode. 
> Oct 12 09:59:03 racoon: INFO: received Vendor ID: CISCO-UNITY 
> Oct 12 09:59:03 racoon: INFO: received Vendor ID:
> draft-ietf-ipsra-isakmp-xauth-06.txt 
> Oct 12 09:59:03 racoon: INFO: received Vendor ID: DPD Oct 12 09:59:03
> racoon: INFO: received broken Microsoft ID: FRAGMENTATION 
> Oct 12 09:59:04 racoon: NOTIFY: couldn't find the proper pskey, try to get
> one by the peer's address. 
> Oct 12 09:59:04 racoon: INFO: ISAKMP-SA established
> 1.1.1.1[500]-2.2.2.2[500] spi:4462e312bc98cfde:4bcb25fec10c5cb1 
> Oct 12 09:59:04 racoon: INFO: initiate new phase 2 negotiation:
> 1.1.1.1[0]<=>2.2.2.2[0] 
> Oct 12 09:59:04 racoon: INFO: purging ISAKMP-SA
> spi=4462e312bc98cfde:4bcb25fec10c5cb1. 
> Oct 12 09:59:04 racoon: INFO: purged IPsec-SA spi=218714308. 
> Oct 12 09:59:04 racoon: INFO: purged ISAKMP-SA
> spi=4462e312bc98cfde:4bcb25fec10c5cb1. 
> Oct 12 09:59:04 racoon: ERROR: unknown Informational exchange received. 
> Oct 12 09:59:05 racoon: INFO: ISAKMP-SA deleted 1.1.1.1[500]-2.2.2.2[500]
> spi:4462e312bc98cfde:4bcb25fec10c5cb1
> 
> 
> I've tried on m0n0wall config, both remote subnet = 172.31.0.0/21 and
> 172.31.0.1/24 and neither have worked so far.
> 
> Thanks,
> Kyle McBride
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: m0n0wall dash unsubscribe at lists dot m0n0 dot ch
> For additional commands, e-mail: m0n0wall dash help at lists dot m0n0 dot ch
>