Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to establish a site-to-site VPN tunnel between an old SOHO3 and an ASA 5505. The ASA has a static IP and the SOHO3 is dynamic. I have tried everything my limited knowledge lets me and need some advice on how to proceed!

Phase 1 (according to the ASA logs) completes - followed by a message saying "All IPSec SA proposals found unacceptable!" so I guess the settings between the two don't match. I have played with various combinations and nothing seems to work - I am overlooking something, just not sure what it is!

Any help would be appreciated.

share|improve this question

From my experience with ASA 5505, I can tell that the access lists don't match.
Start by adding one IP or full subnet in the list of permitted traffic.
Aslo, you have to add a NAT exempt rule for the IP(s) on the other end.

As an example, if the traffic back from the other end is not permitted, the tunnel wont be established.

Try to debug using ASDM and Packet tracer from Tools menu.


share|improve this answer

As Paul said, probably misconfiguration in the access-list that permit traffic from sonicwall to cisco. Give a look a this document:

It's a pix, but the commands should be almost identical. If you have problems, use two debug commands:

debug crypto isakmp
debug crypto ipsec

Lot of output, but you can see exactly what's happening. Give a read here as well:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.