Thanks Max but I'd already looked at the routing and its correct.
The problem is that the router is not identifying the interesting traffic.
show ipsec sa: shows the endpoints and the access-list but when you try to send
data through the VPN the access-list does not catch the traffic
Ie show access-list vpn-traff:
Gives
Access-list vpn-traff x.x.x.x y.y.y.y x.x.x.x y.y.y.y (0)
But then applied to the outside interface the counter ^^^^ goes up !
I actually had a specific route (255.255.255.255 mask) to the other end of the
vpn and if you ping from the PIX the packet exits the correct interface.
-----Original Message-----
From: Massimo Baschieri [mailto:massimo.baschieri@re-ti.it]
Sent: 14 July 2005 06:12
To: Andrew Shore; firewalls@securityfocus.com
Subject: R: PIX encryption interface
If you have a default route pointing to the outside interface you have to
add a specific route in order for the interesting packets to go out to the
desired interface as ipsec encrypts packets on the fly at the outgoing
interface.
For instance, if the remote lan is 192.168.1.0/24 you have to add the
following route to your pix:
Route dmz(or whatever the name is) 192.168.1.0 255.255.255.0
address-of-the-dmz-gateway
Bye,
Max.
-----Messaggio originale-----
Da: Andrew Shore [mailto:andrew.shore@holistecs.com]
Inviato: mercoledì 13 luglio 2005 11.32
A: firewalls@securityfocus.com
Oggetto: PIX encryption interface
Hi all,
I have been having issues with a PIX 515 UR OS 6.3(4) VAC+.
The problem is that when I terminate a VPN on any interface other than the
outside the PIX does not identify any traffic as interesting and does not
encrypt it.
Simply by change the terminating interface to outside causes the PIX to
realise the traffic is destined for the VPN.
Has anyone else seen this behaviour with a PIX before.
In this instance it was not too much of a problem as I swapped the
interfaces around but I have other projects where I need to terminate VPNs
on other interfaces.
Regards,
Andy
