I'm trying to route all web traffic over a site to site ipsec vpn. The vpn is up and running with no issue. The issue I've been struggling with is that I have a route-map statement that is seeing the correct traffic but for some reason its not being flagged by the cryto map statement. Which means the web traffic is heading out my default route and not over the vpn.
I think I'm close but I must be missing something. For the acl 155 statement I"ve also tried any any eq web. I can ping the 192.168.10.1 address from the router only if i source it from the fa0/0 interface. I can ping it from all machiens on then 192.168.30.0/24 network.
My question is what is wrong with my route-map statment that is keeping me from pushing web traffic out the vpn.
Thank you ( obviously 1.1.1.1 and 2.2.2.2 are not the real ip's )
version 12.4
service timestamps debug uptime
service timestamps log datetime
service password-encryption
!
hostname Hex-2811
!
boot-start-marker
boot system flash c2800nm-advsecurityk9-mz.124-24.T5.bin
boot-end-marker
!
no logging buffered
!
aaa new-model
!
!
!
aaa session-id common
clock timezone EST -5
clock summer-time EDT recurring
no ip source-route
!
!
ip cef
!
!
no ip bootp server
ip domain name hexhome.int
ip name-server 192.168.30.8
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
ipv6 unicast-routing
!
!
archive
log config
hidekeys
!
!
ip ssh version 2
!
class-map match-all test
description For VOIP traffic
!
!
!
crypto isakmp policy 1
encr aes 192
authentication pre-share
group 2
lifetime 43200
crypto isakmp key ********* address 2.2.2.2
!
!
crypto ipsec transform-set IOFSET2 esp-aes 192 esp-sha-hmac
!
crypto map IOFVPN 1 ipsec-isakmp
description IoM
set peer 2.2.2.2
set transform-set IOFSET2
match address 154
reverse-route static
!
!
!
!
interface FastEthernet0/0
description Internal 192 Network
ip address 192.168.30.1 255.255.255.0
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
duplex full
speed 100
!
interface FastEthernet0/1
ip address dhcp
ip access-group 112 in
no ip redirects
no ip unreachables
ip accounting access-violations
ip nbar protocol-discovery
ip nat outside
ip virtual-reassembly
no ip route-cache cef
ip policy route-map VPN_WEB
no ip mroute-cache
duplex auto
speed auto
no cdp enable
no mop enabled
crypto map IOFVPN
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 1.1.1.1
!
ip flow-export source FastEthernet0/0
ip flow-export version 5
ip flow-export destination 192.168.30.45 3001
!
no ip http server
ip http access-class 23
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source static tcp 192.168.30.60 443 interface FastEthernet0/1 443
ip nat inside source static tcp 192.168.30.20 21 interface FastEthernet0/1 21
ip nat inside source route-map POLICY-NAT interface FastEthernet0/1 overload
ip nat inside source static tcp 192.168.30.13 80 interface FastEthernet0/1 80
ip nat inside source static tcp 192.168.30.25 44394 interface FastEthernet0/1 44394
ip nat inside source static tcp 192.168.30.13 22 interface FastEthernet0/1 22
ip nat inside source static tcp 192.168.30.12 32400 interface FastEthernet0/1 32400
ip nat inside source static udp 192.168.30.12 32400 interface FastEthernet0/1 32400
ip nat inside source static udp 192.168.30.25 44394 interface FastEthernet0/1 44394
ip nat inside source static tcp 192.168.30.105 5901 interface FastEthernet0/1 5901
ip nat inside source static tcp 192.168.30.200 9443 interface FastEthernet0/1 9443
!
ip access-list extended NAT
deny ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255
permit ip any any
!
access-list 112 remark Explicit accept and deny
access-list 112 deny udp any any eq snmp
access-list 112 deny ip host 50.17.67.227 any
access-list 112 deny ip host 1.93.27.33 any
access-list 112 deny tcp any any eq telnet
access-list 112 permit tcp host 37.235.50.117 any eq ftp log
access-list 112 permit tcp host 5.255.80.84 any eq ftp log
access-list 112 permit tcp host 66.228.62.226 any eq ftp log
access-list 112 permit tcp host 72.25.5.126 any eq 5901 log
access-list 112 permit tcp host 72.25.5.126 any eq 11111 log
access-list 112 permit tcp host 72.25.5.126 any eq 8000 log
access-list 112 deny tcp any any eq ftp log
access-list 112 deny tcp any any eq 3389 log
access-list 112 deny tcp any any eq 5901 log
access-list 112 deny tcp any any eq 11111
access-list 112 deny tcp any any eq 8000
access-list 112 permit ip any any
access-list 154 permit ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 155 permit tcp 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255
snmp-server community public RO
no cdp run
!
route-map VPN_WEB permit 1
match ip address 155
set ip next-hop 192.168.10.1
!
route-map POLICY-NAT permit 10
match ip address NAT
