cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1582
Views
0
Helpful
1
Replies

Can't access loop back at remote site but can access outside interface

moises7777
Level 1
Level 1

I am trying to access three ip addresses on a remote site. The first is a service engine ip address that connects a Unity AIM module, the second is the Unity Ip address and the third is a loop back address.

The remote site connects to our main site via VPN. In the central site there is a VPN concentrator 3000 and a 2811 at the remote site. We currently have connectivity but only to 10.14.0.0 and 10.14.1.0 networks. The ip addresses I am trying to get to are 10.14.5.1, which is a loop back address on the router and 10.14.4.1 and .2, which are the ip addresses of the Unity AIM service module.

Info for service module

interface Service-Engine1/0

ip address 10.14.4.1 255.255.255.252

ip nat inside

ip virtual-reassembly

service-module ip address 10.14.4.2 255.255.255.252

service-module ip default-gateway 10.14.4.1

info for loopback

interface Loopback1

ip address 10.14.5.1 255.255.255.0

no ip redirects

no ip unreachables

no ip proxy-arp

NAT Acl’s

access-list 198 deny   ip any 50.0.0.0 0.255.255.255

access-list 198 deny   ip any 172.16.0.0 0.3.255.255

access-list 198 deny   ip any 55.0.0.0 0.255.255.255

access-list 198 deny   ip any 10.0.0.0 0.0.0.255

access-list 198 permit ip 10.14.0.0 0.0.0.255 any

access-list 198 permit ip 10.14.1.0 0.0.0.255 any

access-list 198 permit ip 10.14.5.0 0.0.0.255 any

access-list 198 permit ip 10.14.4.0 0.0.0.255 any

access-list 199 permit ip 10.14.0.0 0.0.0.255 any

access-list 199 permit ip 10.14.1.0 0.0.0.255 any

network list on the VPN concentrator

10.14.0.0/0.0.255.255

10.13.0.0/0.0.255.255

50.0.0.0/0.255.255.255

192.168.1.2/0.0.0.0

I can ping 10.14.0.1 and 10.14.1.1 which are both interfaces on the router, but I can’t ping 10.14.5.1 which is a loop back address and I can’t ping 10.14.4.1 which is the service module ip address.

I am not sure what I need to add, the routes seem to be there and the ACLs seem right, any help would be appreciated thanks.

1 Reply 1

moises7777
Level 1
Level 1

For anyone that needs it, I had to add this command to both the service module interface and loopback

crypto ipsec client ezvpn CISCOCP_EZVPN_CLIENT_1 inside

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: