The first route is automatically acquired via the PPPoE session from the ISP and the second route is for the VPN, which automatically gets added in it seems. There is no way for me to remove that route..    I can share the configs but the branch router is an RV134W, which has some crappy CLI, completely different to 1921 so not sure how helpful that will be? ... View more

I've done that but now I cannot ping anything from either end...   ping 192.168.3.254 sou gi0/1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.3.254, timeout is 2 seconds: Packet sent with a source address of 192.168.1.254 ..... Success rate is 0 percent (0/5) The router is now trying to NAT the traffic instead rather than send it via the VPN tunnel. Hmmm...  ... View more

That's applied to a route-map for NAT purposes for split tunnel to work.   ip nat inside source route-map internet interface Dialer1 overload route-map internet permit 10 match ip address NAT match interface Dialer1 If I take these out, the VPN won't work as the traffic that's destined for VPN tunnel will instead be NAT'ing out.  ... View more

That's applied to a route-map for NAT purposes for split tunnel to work.   ip nat inside source route-map internet interface Dialer1 overload route-map internet permit 10 match ip address NAT match interface Dialer1 ... View more

There are cisco switches in between, they are layer 2 switches without any routes setup on them.    This was actually working all okay until one day the connection that stopped working. I replaced the DrayTek with RV134W router and got the tunnel up but still not up fully as we obviously cannot access anything from remote location or vise-versa. ... View more

One would think so but I am on 192.168.3.107 and I can ping 192.168.1.254 (1921/K9) but cannot ping 192.168.1.1 or any other IP on that subnet with firewalls off. The same happens if I am on 192.168.1.1 and I can ping 192.168.3.254 (RV134) but cannot ping 192.168.3.107 or any other IP. Firewalls are off on end points. ... View more

  Here are the bits from the 1921 router:   Extended IP access list NAT 10 deny ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255 (19095 matches) 20 deny ip 192.168.1.0 0.0.0.255 10.10.3.0 0.0.0.255 (23 matches) 30 deny ip 10.10.1.0 0.0.0.255 10.10.3.0 0.0.0.255 (10 matches) 40 deny ip 10.10.1.0 0.0.0.255 192.168.3.0 0.0.0.255 90 permit ip any any (228233 matches) Extended IP access list vpn-tunnel 10 permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255 (17007 matches) Routing part Gateway of last resort is 0.0.0.0 to network 0.0.0.0 S* 0.0.0.0/0 is directly connected, Dialer1 10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks C 10.10.1.0/24 is directly connected, GigabitEthernet0/1.100 L 10.10.1.254/32 is directly connected, GigabitEthernet0/1.100 78.0.0.0/32 is subnetted, 1 subnets C 78.33.x.x is directly connected, Dialer1 84.0.0.0/32 is subnetted, 1 subnets C 84.45.x.x is directly connected, Dialer1 192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks C 192.168.1.0/24 is directly connected, GigabitEthernet0/1 L 192.168.1.254/32 is directly connected, GigabitEthernet0/1  I can ping from both ends to the remote location's routers but endpoint cannot ping another endpoint.   So if I am on a remote computer on IP 192.168.3.107 I can then ping 192.168.1.254 (1921 router) but cannot ping 192.168.1.1. If I am on 192.168.1.1, I can ping 192.168.3.254 (rv134 router).  ... View more

So for now I have removed the 10.10.3.0/24 subnet out of the equation, just to see if that makes a difference but it has not. See the screenshots from the Cisco RV134:           ... View more

So for now I have removed the 10.10.3.0/24 subnet out of the equation, just to see if that makes a difference but it has not. See the screenshots from the Cisco RV134:         Here are the bits from the 1921 router:   Extended IP access list NAT 10 deny ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255 (19095 matches) 20 deny ip 192.168.1.0 0.0.0.255 10.10.3.0 0.0.0.255 (23 matches) 30 deny ip 10.10.1.0 0.0.0.255 10.10.3.0 0.0.0.255 (10 matches) 40 deny ip 10.10.1.0 0.0.0.255 192.168.3.0 0.0.0.255 90 permit ip any any (228233 matches) Extended IP access list vpn-tunnel 10 permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255 (17007 matches) Routing part Gateway of last resort is 0.0.0.0 to network 0.0.0.0 S* 0.0.0.0/0 is directly connected, Dialer1 10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks C 10.10.1.0/24 is directly connected, GigabitEthernet0/1.100 L 10.10.1.254/32 is directly connected, GigabitEthernet0/1.100 78.0.0.0/32 is subnetted, 1 subnets C 78.33.x.x is directly connected, Dialer1 84.0.0.0/32 is subnetted, 1 subnets C 84.45.x.x is directly connected, Dialer1 192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks C 192.168.1.0/24 is directly connected, GigabitEthernet0/1 L 192.168.1.254/32 is directly connected, GigabitEthernet0/1   ... View more

No, I did, here is the config from the 1921:   crypto isakmp policy 1 encr 3des hash md5 authentication pre-share group 2 ... View more

That was the 1921 router at the main site.    I am attaching a screenshot from the other location:   ... View more

Please see the output below. Let me know if there is anything else you may need!   IPv4 Crypto ISAKMP SA dst src state conn-id status 84.45.x.x 87.127.x.x QM_IDLE 1429 ACTIVE IPv6 Crypto ISAKMP SA     interface: Dialer1 Crypto map tag: vpn, local addr 84.45.x.x protected vrf: (none) local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (192.168.3.0/255.255.255.0/0/0) current_peer 87.127.x.x port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 329, #pkts encrypt: 329, #pkts digest: 329 #pkts decaps: 501, #pkts decrypt: 501, #pkts verify: 501 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0 local crypto endpt.: 84.45.x.x, remote crypto endpt.: 87.127.x.x plaintext mtu 1438, path mtu 1492, ip mtu 1492, ip mtu idb Dialer1 current outbound spi: 0x73F508FA(1945438458) PFS (Y/N): N, DH group: none inbound esp sas: spi: 0x1C7823DF(477635551) transform: esp-3des esp-md5-hmac , in use settings ={Tunnel, } conn id: 3165, flow_id: Onboard VPN:1165, sibling_flags 80000040, crypto map: vpn sa timing: remaining key lifetime (k/sec): (4299505/936) IV size: 8 bytes replay detection support: Y Status: ACTIVE(ACTIVE) inbound ah sas: inbound pcp sas: outbound esp sas: spi: 0x73F508FA(1945438458) transform: esp-3des esp-md5-hmac , in use settings ={Tunnel, } conn id: 3166, flow_id: Onboard VPN:1166, sibling_flags 80000040, crypto map: vpn sa timing: remaining key lifetime (k/sec): (4299544/936) IV size: 8 bytes replay detection support: Y Status: ACTIVE(ACTIVE) outbound ah sas: outbound pcp sas: protected vrf: (none) local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (10.10.3.0/255.255.255.0/0/0) current_peer 87.127.x.x port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0 local crypto endpt.: 84.45.x.x remote crypto endpt.: 87.127.x.x plaintext mtu 1438, path mtu 1492, ip mtu 1492, ip mtu idb Dialer1 current outbound spi: 0x6A394328(1782137640) PFS (Y/N): N, DH group: none inbound esp sas: spi: 0x8E6643C6(2389066694) transform: esp-3des esp-md5-hmac , in use settings ={Tunnel, } conn id: 3167, flow_id: Onboard VPN:1167, sibling_flags 80000040, crypto map: vpn sa timing: remaining key lifetime (k/sec): (4234055/936) IV size: 8 bytes replay detection support: Y Status: ACTIVE(ACTIVE) inbound ah sas: inbound pcp sas: outbound esp sas: spi: 0x6A394328(1782137640) transform: esp-3des esp-md5-hmac , in use settings ={Tunnel, } conn id: 3168, flow_id: Onboard VPN:1168, sibling_flags 80000040, crypto map: vpn sa timing: remaining key lifetime (k/sec): (4234055/936) IV size: 8 bytes replay detection support: Y Status: ACTIVE(ACTIVE) outbound ah sas: outbound pcp sas: ... View more

I've got a similar setup, with 2 ISPs over PPPoE but because PPPoE is done to the same ISP, one always overwrites the other so the second router was setup as a double-NAT router instead of the modem-only mode with PPP pass-through. I then configured policy based routing to allow for certain traffic to flow over the second connection. ... View more

Going to get the AP back to our office as I am not on site to do it. Thanks for your help. ... View more