Dear all,
I got a problem. I have a cisco router connect to other site by IPsec. From the cisco, VLAN 100 works properly, but VLAN 101 not. Through VLAN 101, I can ping 8.8.8.8, but cannot resolve google.com so that cannot access to the website.
The conf:
ip dhcp pool VLAN100
network 192.168.200.0 255.255.255.128
default-router 192.168.200.1
dns-server 172.25.36.2 172.25.36.9
lease 7
!
ip dhcp pool VLAN101
network 192.168.201.0 255.255.255.0
default-router 192.168.201.1
dns-server 172.25.36.2 172.25.36.9
lease 7
!
interface Tunnel1
ip unnumbered Vlan100
ip access-group IPsec-in in
ip access-group IPsec-out out
tunnel source 201.155.211.114
tunnel mode ipsec ipv4
tunnel destination 221.241.162.33
tunnel protection ipsec profile IPsecProfile
!
interface GigabitEthernet0/0/0
ip address 201.155.211.114 255.255.255.248
ip nat outside
speed 1000
no negotiation auto
!
interface GigabitEthernet0/1/0
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet0/1/1
!
interface GigabitEthernet0/1/2
!
interface GigabitEthernet0/1/3
switchport access vlan 101
switchport mode access
!
interface Vlan1
no ip address
!
interface Vlan100
ip address 192.168.200.1 255.255.255.128
ip nat inside
!
interface Vlan101
ip address 192.168.201.1 255.255.255.0
ip nat inside
!
no ip forward-protocol nd
no ip http server
no ip http secure-server
ip nat inside source list 1 interface GigabitEthernet0/0/0 overload
ip route 0.0.0.0 0.0.0.0 202.155.211.113
ip route 172.25.36.0 255.255.255.128 Tunnel1
!
!
ip access-list extended IPsec-in
10 permit ip any 192.168.200.0 0.0.0.127
20 permit ip any 192.168.201.0 0.0.0.255
30 permit tcp host 172.25.36.68 host 192.168.200.254 eq telnet
40 permit tcp host 172.25.36.90 host 192.168.200.254 eq telnet
ip access-list extended IPsec-out
10 permit ip any any
!
ip access-list standard 1
10 permit 192.168.200.0 0.0.0.127
20 permit 192.168.201.0 0.0.0.255
Where did I config wrongly? Thank you very much!
