Dear All, I am having a client who has one HO and 300 Branch offices. HO is having one leased line and all branches having ADSL(dynamic IP).currently this setup is working fine . There new  requirement is to forward all Internet traffic from branches to HO in branch I have given a default route pointing to the HO tunnel interface IP . now all  traffic is reaching HO and i am able to browse Internet as well, but the issue is that the Internet is dead slow (sometime page will not open also). Am I doing it correctly or any modification needs to be done . Kindly suggest ...   Diagram and config files are attached. Please note that they don't have any proxy server as of now. and in the diagram I am discussing about R4 and R5 routers . thanks Jibson ... View more

Dear all, I am having a PIX firewall in which 20 VPNs are terminated. one of my new requirment is to establish a vpn tunnel to another location in which i dont have access. my side i am having a pool of private ips that is only allowed through the tunnel.I have configured a one to one nat with one of the pool IP and my internal server. I have tried a lot VPN tunnel is not comming up Please check the brief configuration and the attached full configuration. In my config 10.66.100.208 255.255.255.248 is the ip pool and 192.168.0.239 is my server. when i try to ping  192.168.108.75 from 192.168.0.239 VPN acl count is increasing but tunnel is not comming up Please look in to this  and help me to sourt out this issue. ============================================================== access-list NAT permit ip 10.66.100.208 255.255.255.248 host 192.168.108.75 access-list NAT permit ip 10.66.100.208 255.255.255.248 host 10.67.1.5 access-list NI permit ip 10.66.100.208 255.255.255.248 host 192.168.108.75 access-list NI permit ip 10.66.100.208 255.255.255.248 host 10.67.1.5 crypto ipsec transform-set NI esp-3des esp-sha-hmac isakmp policy 25 authentication pre-share isakmp policy 25 encryption 3des isakmp policy 25 hash sha isakmp policy 25 group 5 isakmp policy 25 lifetime 1440 crypto map forsberg 38 ipsec-isakmp crypto map forsberg 38 match address NI crypto map forsberg 38 set peer 1.1.1.250 crypto map forsberg 38 set transform-set NI crypto map forsberg 38 set security-association lifetime seconds 3600 static (inside,outside) 10.66.100.209 192.168.0.239 netmask 255.255.255.255 0 0 isakmp key Fa$1xx!@$ address 1.1.1.250 netmask 255.255.255.255 ====================================================================================== pixfirewall# sh access-list NI access-list NI; 2 elements access-list NI line 1 permit ip 10.66.100.208 255.255.255.248 host 192.168.108.75 (hitcnt=87) access-list NI line 2 permit ip 10.66.100.208 255.255.255.248 host 10.67.1.5 (hitcnt=0) pixfirewall# ... View more