RE: PIX encryption interface

This is not the issues.

The problem appeared to be the other end of the VPN (in this case a checkpoint 
firewall) which would not allow the SAâs to be created.

I think it â.. the pix had established SAs with the CP FW-1 and when the 
interface changed (and the address) it would not form new SAs until the old 
ones had expired.

Because the VPN was not established the PIX was not looking for interesting 
traffic (?)

Ho Hum its working now any way.

Thanks to all who responded â

Andy

________________________________________
From: bjdavenport@comcast.net [mailto:bjdavenport@comcast.net] 
Sent: 13 July 2005 23:20
To: Andrew Shore; firewalls@securityfocus.com
Subject: Re: PIX encryption interface

Â
Make sure you have appropriate crypto maps applied to those interfaces. As well 
as statics to allow intra-pix traffic.
Â
Â
Â
e.g.
Â
crypto map "my-map" in int some-interface
-------------- Original message -------------- 

> Hi all, 
>
>
> I have been having issues with a PIX 515 UR OS 6.3(4) VAC+. 
>
> The problem is that when I terminate a VPN on any interface other than the 
> outside the PIX does not identify any traffic as interesting and does not 
> encrypt it. 
>
> Simply by change the terminating interface to outside causes the PIX to 
> realise 
> the traffic is destined for the VPN. 
>
> Has anyone else seen this behaviour with a PIX before. 
>
> In this instance it was not too much of a problem as I swapped the interfaces 
> around but I have other projects where I need to terminate VPNs on other 
> interfaces. 
>
> Regards, 
>
> Andy