Re: Wierd VPN Issue

Hi,

Try doing debug crypto isakmp & debug crypto ipsec if possible. It could
be possible that the traffic could have the ip address of external ip
address, which might require re-ordering ACLs.

Rgds, Vj

On Mon, 2009-08-31 at 12:37 -0400, groupstudy wrote:
> Hello,
>
> I am having a strange problem that I hope someone can help with.
>
> I have two routers with a LAN-to-LAN VPN tunnel configured between them.
>
> My ACL that specifies what traffic is to be encrypted and sent on the tunnel
> specifies the two destinations at either end:
>
> on Router 1
> access-list 100 permit ip 10.10.10.0 0.255.255.255 20.20.20.0 0.255.255.255
> The local network on router 1 is 10.10.10.0/24
>
> on Router 2
> access-list 100 permit ip 20.20.20.0 0.255.255.255 10.10.10.0 0.255.255.255
> The local network on router 2 is 20.20.20.0/24
>
> The ACLs are mirrored on each router
>
> If I ping 20.20.20.1 (R2's F0/0 int) from R1 sourcing from the 10.10.10.1
> interface (f0/0), the tunnel get established and the ping works (3/5.
> Subsequent pings yield 100% result. The two failed pings occur during the
> time it takes for the tunnel to come up).
>
> The problem is when I ping 20.20.20.1 from a device on the local LAN of R1 (
> 10.10.10.34/24). I cannot ping R2's f0/0. The ACLs include this traffic so
> I am not sure what the cause could be as to why this is not working. I also
> configured an ACL on the F0/0 of R1 to see if the traffic is arriving at the
> interface from the locally connected device (10.10.10.34/24). It is. I'm
> stumped...
>
> Any ideas would be greatly appreciated.
>
> Thanks!
>
>
> Blogs and organic groups at http://www.ccie.net
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html
>
>
>
>
>
>
>

-- 
Rgds, VJ
Blogs and organic groups at http://www.ccie.net