Can anyone help me with this issue... I am sure it has to do with NAT.. The traffic that I want to go down the VPN should be excluded from NAT but I am not sure if I have done this correctly. Any help would be greatly appreciated.. Thanks Carl ... View more

Hi Folks, I have removed my full config file as I was concerned about security.. Also, it was a lot to take in.. I have pasted below the relevant sections of the config file. I believe that this is where my problem lies.  How can I work out which route map is being used by which VPN tunnel. To be honest I am slightly confused about the conflicting nature of some of the commands in the ACL's. They seem to be denying and permitting the same traffic within the same ACL.. Any help would be really appreciated... It seems like I have missed something simple but I just cant find the problem. Even with my VPN tunnel up traffic from 192.168 just wont go out the tunnel but traffic from 10.88 goes out perfectly... What am I missing..??? AAAggghh!!! ip nat inside source route-map SDM_RMAP_1 interface GigabitEthernet0 overload ip nat inside source route-map SDM_RMAP_2 interface GigabitEthernet0 overload ip nat inside source route-map SDM_RMAP_3 interface GigabitEthernet0 overload access-list 101 remark CCP_ACL Category=2 access-list 101 remark NWIH Connection to NIPACS access-list 101 deny   ip 192.168.0.0 0.0.0.255 10.210.0.0 0.0.255.255 access-list 101 remark IPSec Rule access-list 101 deny   ip 10.88.10.0 0.0.0.255 host 192.168.1.2 access-list 101 deny   icmp any any echo-reply access-list 101 remark IPSec Rule access-list 101 deny   ip 10.88.10.0 0.0.0.255 194.138.39.16 0.0.0.7 access-list 101 remark IPSec Rule access-list 101 deny   ip 10.88.10.0 0.0.0.255 10.210.0.0 0.0.255.255 access-list 101 remark IPSec Rule access-list 101 deny   ip 88.151.1.16 0.0.0.7 81.137.191.48 0.0.0.7 access-list 101 permit ip 10.88.10.0 0.0.0.255 any access-list 101 permit ip 192.168.0.0 0.0.0.255 any access-list 150 remark CCP_ACL Category=16 access-list 150 remark NWIH Connection to NIPACS access-list 150 deny   ip 192.168.0.0 0.0.0.255 10.210.0.0 0.0.255.255 access-list 150 remark IPSec Rule access-list 150 deny   ip 10.88.10.0 0.0.0.255 10.210.0.0 0.0.255.255 access-list 150 deny   icmp any any echo-reply access-list 150 remark IPSec Rule access-list 150 deny   ip 10.88.10.0 0.0.0.255 host 192.168.1.2 access-list 150 remark IPSec Rule access-list 150 deny   ip 10.88.10.0 0.0.0.255 194.138.39.16 0.0.0.7 access-list 150 permit ip 192.168.0.0 0.0.0.255 any access-list 150 permit ip 192.168.0.0 0.0.0.255 10.210.0.0 0.0.255.255 access-list 150 permit ip 192.168.0.0 0.0.0.255 194.168.231.0 0.0.0.7 access-list 150 permit icmp any any echo-reply no cdp run route-map SDM_RMAP_1 permit 1 match ip address 101 ! route-map SDM_RMAP_2 permit 1 match ip address 150 ! route-map SDM_RMAP_3 permit 1 match ip address 150 Message was edited by: CARL ALLEN Message was edited by: CARL ALLEN ... View more

Hi Alain I have no access to the other end of the VPN tunnel as this is controlled by the National Health service. However, we have been using the VPN tunnel sucessfully for over a year from the 10.88 network.   Perhaps I need to clarify in my own head what the source IP is for traffic arriving from the 192.168 network.   It originates from a server 192.168.0.170..It gets routed to the FE8 port of the Cisco which is configured to 192.168.0.235. I then do a NAT inside which I presume converts the IP address to a 10.88 address??(Bit shaky on this bit). It is then NATed again by the Outside/Internet port Gigabit Port 0 before going out on to the web..   is this correct?  Howewever, if using a VPN tunnel is any NAT required?? as this will be a direct connection between two sites/routers and hence will not appear on the web?? Apologies for the silly questions and thankyou for your kind assistance. Carl Please see config for ZBF and ACL's below..as Requested.. class-map type inspect match-all sdm-cls-VPNOutsideToInside-1 match access-group 104 class-map type inspect match-all sdm-cls-VPNOutsideToInside-3 match access-group 108 class-map type inspect match-all sdm-cls-VPNOutsideToInside-2 match access-group 107 class-map type inspect imap match-any ccp-app-imap match  invalid-command class-map type inspect match-all sdm-cls-VPNOutsideToInside-5 match access-group 110 class-map type inspect match-any ccp-cls-protocol-p2p match protocol edonkey signature match protocol gnutella signature match protocol kazaa2 signature match protocol fasttrack signature match protocol bittorrent signature class-map type inspect match-all sdm-cls-VPNOutsideToInside-4 match access-group 109 class-map type inspect match-all sdm-cls-VPNOutsideToInside-7 match access-group 112 class-map type inspect match-all sdm-cls-VPNOutsideToInside-6 match access-group 111 class-map type inspect match-all sdm-cls-VPNOutsideToInside-9 match access-group 114 class-map type inspect match-all sdm-cls-VPNOutsideToInside-8 match access-group 113 class-map type inspect smtp match-any ccp-app-smtp match  data-length gt 5000000 class-map type inspect match-any SDM_AH match access-group name SDM_AH class-map type inspect match-any ccp-skinny-inspect match protocol skinny class-map type inspect http match-any ccp-app-nonascii match  req-resp header regex ccp-regex-nonascii class-map type inspect match-any SDM_ESP match access-group name SDM_ESP class-map type inspect match-any SDM_VPN_TRAFFIC match protocol isakmp match protocol ipsec-msft match class-map SDM_AH match class-map SDM_ESP class-map type inspect match-all SDM_VPN_PT match access-group 103 match class-map SDM_VPN_TRAFFIC class-map type inspect match-any ccp-cls-insp-traffic match protocol dns match protocol https match protocol icmp match protocol imap match protocol pop3 match protocol tcp match protocol udp class-map type inspect match-all ccp-insp-traffic match class-map ccp-cls-insp-traffic class-map type inspect match-any ccp-h323nxg-inspect match protocol h323-nxg class-map type inspect match-all sdm-cls-VPNOutsideToInside-10 match access-group 115 class-map type inspect match-all sdm-cls-VPNOutsideToInside-11 match access-group 116 class-map type inspect match-any ccp-cls-icmp-access match protocol icmp match protocol tcp match protocol udp class-map type inspect match-all sdm-cls-VPNOutsideToInside-12 match access-group 117 class-map type inspect match-any ccp-cls-protocol-im match protocol ymsgr yahoo-servers match protocol msnmsgr msn-servers match protocol aol aol-servers class-map type inspect match-all sdm-cls-VPNOutsideToInside-13 match access-group 118 class-map type inspect match-all ccp-protocol-pop3 match protocol pop3 class-map type inspect match-any ccp-h225ras-inspect match protocol h225ras class-map type inspect match-any IDS7 match protocol http match protocol tcp match protocol icmp class-map type inspect match-all ccp-cls-ccp-inspect-1 match access-group name NWIH match class-map IDS7 class-map type inspect match-any ccp-h323annexe-inspect match protocol h323-annexe class-map type inspect pop3 match-any ccp-app-pop3 match  invalid-command class-map type inspect match-all ccp-protocol-p2p match class-map ccp-cls-protocol-p2p class-map type inspect match-any ccp-h323-inspect match protocol h323 class-map type inspect match-all ccp-protocol-im match class-map ccp-cls-protocol-im class-map type inspect match-all ccp-icmp-access match class-map ccp-cls-icmp-access class-map type inspect match-all ccp-invalid-src match access-group 100 class-map type inspect http match-any ccp-app-httpmethods match  request method bcopy match  request method bdelete match  request method bmove match  request method bpropfind match  request method bproppatch match  request method connect match  request method copy match  request method delete match  request method edit match  request method getattribute match  request method getattributenames match  request method getproperties match  request method index match  request method lock match  request method mkcol match  request method mkdir match  request method move match  request method notify match  request method options match  request method poll match  request method post match  request method propfind match  request method proppatch match  request method put match  request method revadd match  request method revlabel match  request method revlog match  request method revnum match  request method save match  request method search match  request method setattribute match  request method startrev match  request method stoprev match  request method subscribe match  request method trace match  request method unedit match  request method unlock match  request method unsubscribe class-map type inspect match-any ccp-sip-inspect match protocol sip class-map type inspect http match-any ccp-http-blockparam match  request port-misuse im match  request port-misuse p2p match  request port-misuse tunneling class-map type inspect match-all ccp-protocol-imap match protocol imap class-map type inspect match-all ccp-protocol-smtp match protocol smtp class-map type inspect match-all ccp-protocol-http match protocol http ! ! policy-map type inspect ccp-permit-icmpreply class type inspect ccp-icmp-access   inspect class class-default   pass policy-map type inspect sdm-pol-VPNOutsideToInside-1 class type inspect sdm-cls-VPNOutsideToInside-1   inspect class type inspect sdm-cls-VPNOutsideToInside-2   inspect class type inspect sdm-cls-VPNOutsideToInside-3   pass class type inspect sdm-cls-VPNOutsideToInside-4   pass class type inspect sdm-cls-VPNOutsideToInside-5   pass class type inspect sdm-cls-VPNOutsideToInside-6   pass class type inspect sdm-cls-VPNOutsideToInside-7   pass class type inspect sdm-cls-VPNOutsideToInside-8   pass class type inspect sdm-cls-VPNOutsideToInside-9   pass class type inspect sdm-cls-VPNOutsideToInside-10   pass class type inspect sdm-cls-VPNOutsideToInside-11   pass class type inspect sdm-cls-VPNOutsideToInside-12   pass class type inspect sdm-cls-VPNOutsideToInside-13   pass class class-default   drop policy-map type inspect smtp ccp-action-smtp class type inspect smtp ccp-app-smtp   reset policy-map type inspect imap ccp-action-imap class type inspect imap ccp-app-imap   log   reset policy-map type inspect pop3 ccp-action-pop3 class type inspect pop3 ccp-app-pop3   log   reset policy-map type inspect ccp-inspect class type inspect ccp-cls-ccp-inspect-1   inspect class type inspect ccp-invalid-src   drop log class type inspect ccp-protocol-http   inspect class type inspect ccp-protocol-smtp   inspect   service-policy smtp ccp-action-smtp class type inspect ccp-protocol-imap   inspect   service-policy imap ccp-action-imap class type inspect ccp-protocol-pop3   inspect   service-policy pop3 ccp-action-pop3 class type inspect ccp-protocol-p2p   drop log class type inspect ccp-protocol-im   drop log class type inspect ccp-insp-traffic   inspect class type inspect ccp-sip-inspect   inspect class type inspect ccp-h323-inspect   inspect class type inspect ccp-h323annexe-inspect   inspect class type inspect ccp-h225ras-inspect   inspect class type inspect ccp-h323nxg-inspect   inspect class type inspect ccp-skinny-inspect   inspect class class-default   drop policy-map type inspect http ccp-action-app-http class type inspect http ccp-http-blockparam   log   reset class type inspect http ccp-app-httpmethods   log   reset class type inspect http ccp-app-nonascii   log   reset policy-map type inspect ccp-permit class type inspect SDM_VPN_PT   pass class class-default   drop ! zone security in-zone zone security out-zone zone-pair security ccp-zp-out-self source out-zone destination self service-policy type inspect ccp-permit zone-pair security ccp-zp-in-out source in-zone destination out-zone service-policy type inspect ccp-inspect zone-pair security ccp-zp-self-out source self destination out-zone service-policy type inspect ccp-permit-icmpreply zone-pair security sdm-zp-VPNOutsideToInside-1 source out-zone destination in-zone service-policy type inspect sdm-pol-VPNOutsideToInside-1 ! ! crypto isakmp policy 1 encr aes authentication pre-share group 5 lifetime 3600 ! crypto isakmp policy 2 encr 3des authentication pre-share group 2 ! crypto isakmp policy 3 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key XA1APhRF97QSJJ28d3UXc2UbinTapLZjR5oi7igxbCULuDc3fq9BTbLyME4Jmqn address 194.168.231.2 crypto isakmp key ScannerMRI321 address 194.138.39.1 crypto isakmp key MRIScanner2010 address 81.133.132.134 ! ! crypto ipsec transform-set ESP-3DES-SHA7 esp-3des esp-sha-hmac crypto ipsec transform-set ESP-AES128-SHA esp-aes esp-sha-hmac crypto ipsec transform-set Siemens esp-3des esp-md5-hmac ! crypto map SDM_CMAP_1 3 ipsec-isakmp description Tunnel to194.168.231.2 set peer 194.168.231.2 set security-association lifetime seconds 1800 set transform-set ESP-AES128-SHA set pfs group5 match address 106 crypto map SDM_CMAP_1 4 ipsec-isakmp description Dr Taylor set peer 81.133.132.134 set transform-set ESP-3DES-SHA7 set pfs group2 match address 102 crypto map SDM_CMAP_1 5 ipsec-isakmp description Tunnel to194.138.39.1 set peer 194.138.39.1 set transform-set Siemens match address 105 ... View more