(Router is ISR 1921) This is doing my head in. I am not using NAT, there are no ACLs, there is no split horizon. Here is what I have. It is practically generated by CCP. When connected I cannot ping the loopback interface or the gig0/0 interface, (not to mention anything else). version 15.0 service config service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname dcsgw1 ! boot-start-marker boot-end-marker ! ! aaa new-model ! ! aaa authentication login default local aaa authentication login ciscocp_vpn_xauth_ml_1 local aaa authorization exec default local aaa authorization network ciscocp_vpn_group_ml_1 local ! ! ! ! ! aaa session-id common ! ! ! ! no ipv6 cef ip source-route ip cef ! ! ! ! ip domain name domain.com.au ! multilink bundle-name authenticated ! ! crypto pki trustpoint TP-self-signed-2967037066 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-2967037066 revocation-check none rsakeypair TP-self-signed-2967037066 ! ! ! username conrad privilege 5 secret 5 passwordhash username administrator privilege 15 secret 5 passwordhash ! redundancy ! ! ! ! crypto isakmp policy 1 encr 3des authentication pre-share group 2 ! crypto isakmp policy 2 encr aes 192 group 2 ! crypto isakmp client configuration group DCSVPNGRP1 key *&%#v87bq3 dns 10.1.1.1 wins 10.1.1.8 domain domain.com.au pool SDM_POOL_1 save-password netmask 255.255.255.0 crypto isakmp profile ciscocp-ike-profile-1    match identity group DCSVPNGRP1    client authentication list ciscocp_vpn_xauth_ml_1    isakmp authorization list ciscocp_vpn_group_ml_1    client configuration address respond    virtual-template 1 ! ! crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac ! crypto ipsec profile CiscoCP_Profile1 set transform-set ESP-3DES-SHA set isakmp-profile ciscocp-ike-profile-1 ! ! ! ! ! ! interface Loopback0 ip address 192.168.1.1 255.255.255.0 ! ! interface GigabitEthernet0/0 ip address 10.1.1.6 255.255.255.0 ip tcp adjust-mss 1412 duplex auto speed auto ! ! interface GigabitEthernet0/1 description $ETH-WAN$ no ip address duplex auto speed auto pppoe enable group global pppoe-client dial-pool-number 1 ! ! interface Virtual-Template1 type tunnel ip unnumbered Loopback0 tunnel mode ipsec ipv4 tunnel protection ipsec profile CiscoCP_Profile1 ! ! interface Dialer0 ip address negotiated ip mtu 1452 encapsulation ppp dialer pool 1 dialer-group 1 ppp authentication pap callin ppp pap sent-username username password 0 password ! ! ip local pool SDM_POOL_1 192.168.1.2 192.168.1.32 ip forward-protocol nd ! ip http server ip http authentication local ip http secure-server ! ip route 0.0.0.0 0.0.0.0 Dialer0 ! dialer-list 1 protocol ip permit ! ! ! ! ! ! control-plane ! ! ! line con 0 logging synchronous line aux 0 line vty 0 4 transport input ssh ! ... View more