Site To Site VPN - cant access internal LAN

[AdiMahluf]

Hello friends,

Recently i configured Site to Site IPSEC VPN between my ISR4331 router on the main office and a Fortigate unit on one of our branches.
The connection looks fine, but the only problem i'm facing with is to access both internal LAN, while ping to the D.G is working just fine.
When inspecting the configuration on the Cisco side, i discovered a few configurations that relate to the problem:

1. ip nat inside source route-map WAN2-NAT interface GigabitEthernet0/0/1 overload

2. route-map WAN2-NAT permit 10
match ip address EXIT-WAN2

3. ip access-list extended EXIT-WAN2
permit ip host 10.10.10.32 any
permit ip host 10.10.10.50 any

When removing the route map, pings from both sides can reach other's side internal LAN, but some of the ip addresses cant exit from WAN2 anymore. since i need those specific ip addresses to exit from WAN2 and not WAN1 on other physical port, i cant remove it.

Any suggestions for configurations change?

Thank you in advance

[Dennis Mink]

I am assuming you want the traffic across the IPSEC tunnel NOT to be natted.

so

above your rule:

ip nat inside source route-map WAN2-NAT interface GigabitEthernet0/0/1 overload

put a more specific rule that does a no-nat, ie. source and destination remain original and not natted, stick this rule above your overload rule and it should get preference.

[Francesco Molino]

Hi

You can add at the first position of your acl a line that will do:
Deny ip subnet-lan subnet-remote-lan


In this acl, you just have 2 IPs, which means the others should be able to ping remote LAN. Have you tried?

[AdiMahluf]

Thank you for your reply Francesco!

Your suggestion did worked for me.

Maybe its because i'm not specialist on this section of Cisco, but i left with wondering - if i deny local subnet from remote subnet, how come the connection now works? it should deny and not allow, is it?

Thank you again

[Francesco Molino]

When you have a nat access-list, by allowing you will ask the router to actually nat the traffic hitting this ace. If you deny, you will say to not nat this traffic.
Over this nat interface, some traffic need to be natted and some not, that's why you put at the beginning all deny and then allow statements.