Had the PIX side changed to 172.31.0.0/21 to 192.168.87.0/24 in his acl instead of
the three specific hosts. Tunnel came right up.
I guess the answer to my question is "no" - not supported.
Kyle McBride wrote:
> Greetings,
>
> Need some assistance on m0n0wall to PIX IPSec issue. Cisco guy gave me the
> following as his setup, not a subnet specified in his ACL but 3 specific
> hosts. The 192.168.87.0/24 is my local subnet on m0n0wall side (below
> 1.1.1.1 is m0n0wall public IP and 2.2.2.2 is PIX public IP):
>
> access-list nonat extended permit ip host 172.31.0.1 192.168.87.0
> 255.255.255.0
> access-list nonat extended permit ip host 172.31.0.80 192.168.87.0
> 255.255.255.0
> access-list nonat extended permit ip host 172.31.1.90 192.168.87.0
> 255.255.255.0
>
> access-list 600 extended permit ip host 172.31.0.1 192.168.87.0
> 255.255.255.0
> access-list 600 extended permit ip host 172.31.0.80 192.168.87.0
> 255.255.255.0
> access-list 600 extended permit ip host 172.31.1.90 192.168.87.0
> 255.255.255.0
>
> tunnel-group 1.1.1.1 type ipsec-l2l
> tunnel-group 1.1.1.1 ipsec-attributes
> pre-shared-key **************
>
> crypto map newmap 600 match address 600
> crypto map newmap 600 set peer 1.1.1.1
> crypto map newmap 600 set transform-set ESP-3DES-MD5
>
>
> Here is the log from m0n0wall.
>
> Oct 12 09:59:03 racoon: INFO: IPsec-SA request for 216.118.82.254 queued due
> to no phase1 found.
> Oct 12 09:59:03 racoon: INFO: initiate new phase 1 negotiation:
> 1.1.1.1[500]<=>2.2.2.2[500]
> Oct 12 09:59:03 racoon: INFO: begin Aggressive mode.
> Oct 12 09:59:03 racoon: INFO: received Vendor ID: CISCO-UNITY
> Oct 12 09:59:03 racoon: INFO: received Vendor ID:
> draft-ietf-ipsra-isakmp-xauth-06.txt
> Oct 12 09:59:03 racoon: INFO: received Vendor ID: DPD Oct 12 09:59:03
> racoon: INFO: received broken Microsoft ID: FRAGMENTATION
> Oct 12 09:59:04 racoon: NOTIFY: couldn't find the proper pskey, try to get
> one by the peer's address.
> Oct 12 09:59:04 racoon: INFO: ISAKMP-SA established
> 1.1.1.1[500]-2.2.2.2[500] spi:4462e312bc98cfde:4bcb25fec10c5cb1
> Oct 12 09:59:04 racoon: INFO: initiate new phase 2 negotiation:
> 1.1.1.1[0]<=>2.2.2.2[0]
> Oct 12 09:59:04 racoon: INFO: purging ISAKMP-SA
> spi=4462e312bc98cfde:4bcb25fec10c5cb1.
> Oct 12 09:59:04 racoon: INFO: purged IPsec-SA spi=218714308.
> Oct 12 09:59:04 racoon: INFO: purged ISAKMP-SA
> spi=4462e312bc98cfde:4bcb25fec10c5cb1.
> Oct 12 09:59:04 racoon: ERROR: unknown Informational exchange received.
> Oct 12 09:59:05 racoon: INFO: ISAKMP-SA deleted 1.1.1.1[500]-2.2.2.2[500]
> spi:4462e312bc98cfde:4bcb25fec10c5cb1
>
>
> I've tried on m0n0wall config, both remote subnet = 172.31.0.0/21 and
> 172.31.0.1/24 and neither have worked so far.
>
> Thanks,
> Kyle McBride
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: m0n0wall dash unsubscribe at lists dot m0n0 dot ch
> For additional commands, e-mail: m0n0wall dash help at lists dot m0n0 dot ch
>
| 