[FW-1] FW-1 Site-to-site VPN with Cisco PIX in the middle.

[Ole Jakobsen <olj@FW1-NOSPAMKB.DK>]

Hi all,

Again. Sorry about the first mail. It wasn't suppost to be sent unfinished so here I go again.

I have a small problem I need some new eyes on.

My setup:

Users [192.168.60.x] ---- FW/NAT ---- [172.16.x.y] Partner FW/NAT ---- ISP/Internet ---- HQ FW/VPN GW 
                            |                           |                                      |
                         Nokia IP71                  Cisco PIX                          Nokia IP440 (MGMT)


My goal is to do site-to-site VPN between the two Nokia box's.

I have done a "fw putkey" on both enforcement points. The management station can se the IP71 and gives it the status "untrusted" in the System status windows.
Both run FW-1 4.1.

The setup has work in our test lab but there we didn't have a firewall/NAT device in between. 

The PIX is doing STATIC NAT to my IP71. In the PIX port TCP 50 TCP 264 UDP/TCP 500 UDP 2746 in opened both ways. What I'm I missing?

Please help :o)


Best Regards,

Ole Jakobsen