VPN tunnel no route to remote networks

[GeirF]

Hi

I have stumbled into some routing problems on our ISR2900.

We use this 2900 to run all our ipsec tunnels.

Yesterday we configured a new tunnel to a external company. 

client -> tunnel -> 2900 -> 2900-inside -> Cisco ASA -> ping local networks = OK

client -> tunnel ->  2900 -> 2900-outside -> Palo Alto -> ping internet = NOT OK

I see the return trafikk comes back to the 2900-outside from Palo Alto. I did a packet capture on the 2900-outside to confirm this.

When i ping the client from a DMZ host (terminated on the Palo Alto) i get the "Destination net unreachable"

When i ping from the local networks i get the ping respons from the client.

Why is the traffic entering 2900-inside routed into the tunnel from the local networks and not from the Palo Alto via 2900-outside ?

Regards,

Geir

[balaji.bandi]

if you disable the newly configured tunnel, is that works expected?

we also need some diagrams the one mentioned, config also some route output.

[MHM Cisco World]

can you draw topology ?

[GeirF]

Hi

The topology:

Regards,
Geir

[Georg Pauwen]

Hello,

post the full running configuration

(sh run)

of the 2900 router.

[MHM Cisco World]

client -> tunnel ->  2900 -> 2900-outside -> Palo Alto -> ping internet = NOT OK

here you need to make subnet of client NAT (overload) in Palo FW to make it reach internet, remember the internet know only OUT of Palo IP not know the IP of client 

[GeirF · Accepted solution]

Hi

I went over the config and prepared it for posting here. 

When i was almost ready to post the code i discovered an old acl that was mapped to the outside interface,

I saw that the client ip range was missing. Added the missing ip range and i got it all working.

Thanks for helping me out.

Regards,
Geir

[MHM Cisco World]

glad your issue is solved 
good job friend