Hi Mark, routing spoke to spoke in not an issue. Be sure that your destination is included in the network of the draytek's vpn. Post your config will help to get you more detailed suggestion. Regards. Gianluca ... View more

You are the best!!! The solution was your last... only one crypto acl work done and so the only one I can use is: 10.0.0.0 0.255.255.255 100.100.100.0 0.0.0.255 I'm so satisfy of that! So much night spent to debug! Thanks again... ... View more

Dear Jathaval, if could help, while i ping 10.20.20.15 from host 100.100.100.2 in B i issue the following debug on cisco 881 in A: debug ip cef drop debug ip icmp I can see all transaction about the packets involved in ping and i cannot see any packet from 10.20.20.15. It is correct for you? Another helpful thing is that if I replace the cisco 881 in A with another draytek all work fine. Thanks for your help... Gianluca ... View more

OK, i attached the revisioned config of router A. Below the step you suggest: router_internet#sh crypto ipsec sa peer 88.88.88.88 interface: FastEthernet4     Crypto map tag: vpn_map, local addr 192.168.1.2    protected vrf: (none)    local  ident (addr/mask/prot/port): (10.10.10.0/255.255.255.0/0/0)    remote ident (addr/mask/prot/port): (100.100.100.0/255.255.255.0/0/0)    current_peer 88.88.88.88 port 500      PERMIT, flags={origin_is_acl,}     #pkts encaps: 53510, #pkts encrypt: 53510, #pkts digest: 53510     #pkts decaps: 52870, #pkts decrypt: 52870, #pkts verify: 52870     #pkts compressed: 0, #pkts decompressed: 0     #pkts not compressed: 0, #pkts compr. failed: 0     #pkts not decompressed: 0, #pkts decompress failed: 0     #send errors 1599, #recv errors 0      local crypto endpt.: 192.168.1.2, remote crypto endpt.: 88.88.88.88      path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet4      current outbound spi: 0x57AE5DBF(1471045055)      inbound esp sas:       spi: 0xF9A96AE(261789358)         transform: esp-3des esp-sha-hmac ,         in use settings ={Tunnel, }         conn id: 301, flow_id: Motorola SEC 1.0:301, crypto map: vpn_map         sa timing: remaining key lifetime (k/sec): (4404611/3581)         IV size: 8 bytes         replay detection support: Y         Status: ACTIVE      inbound ah sas:      inbound pcp sas:      outbound esp sas:       spi: 0x57AE5DBF(1471045055)         transform: esp-3des esp-sha-hmac ,         in use settings ={Tunnel, }         conn id: 302, flow_id: Motorola SEC 1.0:302, crypto map: vpn_map         sa timing: remaining key lifetime (k/sec): (4404610/3581)         IV size: 8 bytes         replay detection support: Y         Status: ACTIVE      outbound ah sas:      outbound pcp sas:    protected vrf: (none)    local  ident (addr/mask/prot/port): (10.20.20.0/255.255.255.0/0/0)    remote ident (addr/mask/prot/port): (100.100.100.0/255.255.255.0/0/0)    current_peer 88.88.88.88 port 500      PERMIT, flags={origin_is_acl,}     #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0     #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0     #pkts compressed: 0, #pkts decompressed: 0     #pkts not compressed: 0, #pkts compr. failed: 0     #pkts not decompressed: 0, #pkts decompress failed: 0     #send errors 0, #recv errors 0      local crypto endpt.: 192.168.1.2, remote crypto endpt.: 88.88.88.88      path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet4      current outbound spi: 0x0(0)      inbound esp sas:      inbound ah sas:      inbound pcp sas:      outbound esp sas:      outbound ah sas:      outbound pcp sas: ------- there are two sa with one tunnel as you mentioned -------- router_internet#sh crypto session remote 88.88.88.88 Crypto session current status Interface: FastEthernet4 Session status: UP-ACTIVE   Peer: 88.88.88.88 port 500   IKE SA: local 192.168.1.2/500 remote 88.88.88.88/500 Active   IPSEC FLOW: permit ip 10.10.10.0/255.255.255.0 100.100.100.0/255.255.255.0         Active SAs: 2, origin: crypto map   IPSEC FLOW: permit ip 10.20.20.0/255.255.0.0 100.100.100.0/255.255.255.0         Active SAs: 0, origin: crypto map ------ why the second ipsec flow have no Active SAs? It is correct? ------------- after some "ping 10.20.20.15" from host 100.100.100.10 the ping command was unsuccessfully completed and I can see 10 matches in acl. router_internet#sh access-lists 101 Extended IP access list 101     10 permit ip 10.10.10.0 0.0.0.255 100.100.100.0 0.0.0.255 (137697 matches)     20 permit ip 10.20.20.0 0.0.0.255 100.100.100.0 0.0.0.255 (10 matches) I can't find any command to debug sa. There is any other debug that make me able to see where packets was discard o block? Thanks again... ... View more

Dear Jathaval, thank you for you promptly response. There is only a standard VPN ipsec between A and B; you can see the A config in the attached file. It is very interesting for me to be able to debug the traffic when i ping D (10.20.20.15) from B and see what happen in A. Can you suggest me how can i debug the above scenario? Thanks again. ... View more