This is my setup.
I have a sub-interface with private IPs that also uses HSRP.
I also have "ip nat inside" on the sub interface but have excluded networks going through the VPN.
I have the VPN source 192.168.100.1 one-to-one NAT to a public IP 1.1.1.1. (not really 1.1.1.1) on my Edge router
The second HSRP router is off to eliminate any extra issues, so Core1 is active (see "show standby brief below)"
The VPN looks up.
It looks like the Crpto map is not catching the Private IPs
If I trace from a computer with the IP of 192.168.100.25 It hits 192.168.100.2 then to the Edge device. It should not do this, it should go through the VPN
I also made sure that 192.168.100.25 is not being natted on Core1
----------------------------------------------------------------
Configs on Core1
crypto isakmp key TESTKEY address 1.1.1.1
!
!
crypto ipsec transform-set MYSET esp-aes 256 esp-md5-hmac
mode tunnel
!
!
!
crypto map BWI 1 ipsec-isakmp
description To-Remote
set peer 1.1.1.1
set transform-set MYSET
match address To-Remote-VPN
interface GigabitEthernet0/0/0.100
description Private
encapsulation dot1Q 100
ip address 192.168.100.2 255.255.255.0
no ip redirects
ip nat inside
standby 100 ip 192.168.100.1
standby 100 name Vlan100
standby 100 track 1 decrement 60
cdp enable
crypto map BWI redundancy Vlan100
ip access-list extended To-Remote-VPN
permit ip 192.168.100.0 0.0.0.255 10.10.10.0 0.0.0.255 log
ip access-list extended NAT-SOURCE
deny ip 192.168.100.0 0.0.0.255 10.10.10.0 0.0.0.255
deny ip host 192.168.100.2 any //////////////// I do not think I need this but I added just to be safe/////////////
deny ip host 192.168.100.1 any //////////////// I do not think I need this but I added just to be safe/////////////
permit ip 192.168.100.0 0.0.0.255 any
-----------------------------------------------------
Show commands below.
Core1#sho crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
192.168.100.1 1.1.1.1 QM_IDLE 1003 ACTIVE
Core1#sho crypto ipse sa
interface: GigabitEthernet0/0/0.100
Crypto map tag: BWI, local addr 192.168.100.1
protected vrf: (none)
local ident (addr/mask/prot/port): (192.168.100.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (10.10.10.0/255.255.255.0/0/0)
current_peer 1.1.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 192.168.100.1, remote crypto endpt.: 1.1.1.1
plaintext mtu 1500, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0/0.100
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
/////////////////////////////////////////////as you can see the VPN is up///////////////////////////////////
SCore11#sho stan b
P indicates configured to preempt.
|
Interface Grp Pri P State Active Standby Virtual IP
Gi0/0/0.10 100 150 P Active local unknown 192.168.100.1
-----------------------------------------------------------------------
To recap:
The VPN is up but it seems like the IPs 192.168.100.0/24 are not hitting the crypto map entering or exiting. I feel like this is a simple fix. I feel like I am just overlooking something. I have setup VPNs hundreds of time but not like this...
If I send packets for the remote side and issue the command "sho crypto ipse sa" I can see packets getting encrypted and if I issue the same command on Core1 I do not see any packets being decrypted.
Thanks for your input :)
