nfx
The Wire
Premium
join:2001-05-21
Vancouver, BC
clubs:
2 edits | reply to bigdogg2
Re: Issues with Cisco 871 tunnel with Pix515e
crypto map SiteToSiteVPN 1 match address inside_cryptomap
crypto map SiteToSiteVPN 1 set peer 10.44.44.2
crypto map SiteToSiteVPN 1 set transform-set ESP-3DES-MD5 ESP-DES-MD5 xform-3des-md5
crypto map SiteToSiteVPN interface inside
Is this the crypto map you're using for the site-to-site VPN?
If so, the ACL it's matching, inside_cryptomap, only allows IP traffic.
This is the ACL it's matching: access-list inside_cryptomap extended permit ip 10.35.1.0 255.255.255.0 10.44.44.0 255.255.255.0
You need to add ICMP to that ACL.
edit: Same for the 871 config, you need to add ICMP to the ACL called "tunnel".
--
nfx |
|
bigdogg2
join:2004-08-11
| When you do a "permit ip" you are permitting everything over the protocol stack which would include TCP, UDP and ICMP.
I did fix the issue by removing "ip nat inside" on "int vlan1" and removing "ip nat outside" from "int f4". Since vlan 1 was not coming up I added my Loop Back IP into the tunnel ACL and then I was able to ping and telnet to ports on both sides of the crypto tunnel. |
|
nfx
The Wire
Premium
join:2001-05-21
Vancouver, BC
clubs: | You're right. I had to go back and review CCNA material to realize this. Thanks.
--
nfx |
|
