Hi, I need help. I have cisco 4331 with 3 interfaces. GigabitEthernet0/0/0 goes to Internet via Dialer1. GigabitEthernet0/0/1 goes to MPLS L3VPN.It is connected to CE router. GigabitEthernet0/0/2 goes to LAN. It works perfectly. Hosts have access to VPN and Internet from lan. Now I need to connect several remote clients and give them access to lan and vpn 10.177.X.X. I tried to configure easy vpn. A client connects to the easy vpn server successfully, but it can only ping hosts from lan. Cisco webui or ssh doesn't work. 10.177.x.x net is also unreachable for the remote client. What I see myself is that I have a conflict in my access lists. They both point to the same subnet. Is there any way to wtite to the easyvpn's access list only ip 192.168.1.70-192.168.1.85? The second issue is "ip nat outside" on Dialer1 inerface. I don't know is it right for easy vpn. ! ! Last configuration change at 23:47:04 GMT Sat Mar 2 2019 ! version 16.6 service timestamps debug datetime msec service timestamps log datetime msec service password-encryption platform qfp utilization monitor load 80 no platform punt-keepalive disable-kernel-core ! hostname puhsbyt ! boot-start-marker boot system flash bootflash:isr4300-universalk9.16.06.05.SPA.bin boot-end-marker ! ! vrf definition Mgmt-intf ! address-family ipv4 exit-address-family ! address-family ipv6 exit-address-family ! logging console emergencies enable secret 5 ! ! transport-map type persistent ssh sshhandler time-out 30 rsa keypair-name sshkeys transport interface GigabitEthernet0 connection wait allow interruptible ! transport-map type persistent telnet telnethandler ! aaa new-model ! ! aaa authentication login default local aaa authentication login USER-AUTH local aaa authorization exec default local aaa authorization network GROUP-AUTH local ! ! ! ! ! ! aaa session-id common no process cpu autoprofile hog clock timezone GMT 3 0 ! ! ! ! ! ! ip nbar http-services ! ! ! ip domain name test.com ! ip dhcp pool Sbyt network 192.168.1.0 255.255.255.0 default-router 192.168.1.1 dns-server 194.158.196.137 194.158.196.141 ! ! ! ! ! ! ! ! ! ! subscriber templating ! ! ! ! ! ipv6 unicast-routing ! ! multilink bundle-name authenticated ! ! ! ! ! ! ! crypto pki trustpoint TP-self-signed-1843133077 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-1843133077 revocation-check none rsakeypair TP-self-signed-1843133077 ! ! crypto pki certificate chain TP-self-signed-1843133077 certificate self-signed 01 quit ! ! ! ! ! ! ! ! ! ivr prompt buffers 2 license udi pid ISR4331/K9 sn license accept end user agreement license boot level appxk9 license boot level uck9 license boot level securityk9 diagnostic bootup level minimal spanning-tree extend system-id ! ! ! username dima privilege 15 username admin privilege 15 username rud1 password 7 ! redundancy mode none ! ! ! ! ! vlan internal allocation policy ascending ! no cdp run ! ! ! ! ! ! ! ! crypto isakmp policy 10 hash md5 authentication pre-share group 2 ! crypto isakmp client configuration group RUD-GROUP key RUD dns 192.168.1.1 pool EZVPN-POOL acl 110 crypto isakmp profile VPN-CLIENT match identity group RUD-GROUP client authentication list USER-AUTH isakmp authorization list GROUP-AUTH client configuration address respond ! ! crypto ipsec transform-set 3DES-MD5 esp-3des esp-md5-hmac mode tunnel ! ! ! crypto dynamic-map DYNMAP 10 set transform-set 3DES-MD5 set isakmp-profile VPN-CLIENT reverse-route ! ! crypto map DMAP 1 ipsec-isakmp dynamic DYNMAP ! ! ! ! ! ! ! ! interface GigabitEthernet0/0/0 ip address dhcp ip mtu 1452 ip nat outside ip nbar protocol-discovery ip tcp adjust-mss 1412 negotiation auto pppoe enable group global pppoe-client dial-pool-number 1 spanning-tree portfast trunk ! interface GigabitEthernet0/0/1 ip address dhcp ip nat outside negotiation auto ! interface GigabitEthernet0/0/2 ip address 192.168.1.1 255.255.255.0 ip nat inside negotiation auto spanning-tree portfast disable ! interface GigabitEthernet0/1/0 shutdown spanning-tree portfast disable ! interface GigabitEthernet0/1/1 shutdown spanning-tree portfast disable ! interface GigabitEthernet0/1/2 switchport mode access shutdown spanning-tree portfast trunk ! interface GigabitEthernet0/1/3 shutdown spanning-tree portfast disable ! interface GigabitEthernet0 vrf forwarding Mgmt-intf no ip address shutdown negotiation auto no cdp enable ! interface Vlan1 no ip address shutdown ! interface Dialer1 ip address negotiated ip mtu 1452 ip nat outside encapsulation ppp ip tcp adjust-mss 1412 dialer pool 1 dialer idle-timeout 0 dialer persistent dialer-group 1 no cdp enable ppp mtu adaptive ppp authentication chap pap callin ppp chap hostname ppp chap password ppp pap sent-username ppp ipcp dns request crypto map DMAP ! ip local pool EZVPN-POOL 192.168.1.70 192.168.1.85 ip nat inside source route-map NAT_TO_ISP interface Dialer1 overload ip nat inside source route-map NAT_TO_VPN interface GigabitEthernet0/0/1 overload ip forward-protocol nd ip ftp username 1 ip ftp password 7 ip http server ip http authentication local ip http secure-server ip tftp source-interface GigabitEthernet0 ip route 0.0.0.0 0.0.0.0 Dialer1 ip route 10.177.0.0 255.255.0.0 10.177.106.1 ! ip ssh version 2 ! access-list 1 permit 192.168.1.0 0.0.0.255 access-list 110 permit ip 192.168.1.0 0.0.0.255 any dialer-list 1 protocol ip permit ! ! route-map NAT_TO_VPN permit 20 match ip address 1 match interface GigabitEthernet0/0/1 ! route-map NAT_TO_ISP permit 10 match ip address 1 match interface Dialer1 GigabitEthernet0/0/0 ! ! ! ! ! control-plane ! ! mgcp behavior rsip-range tgcp-only mgcp behavior comedia-role none mgcp behavior comedia-check-media-src disable mgcp behavior comedia-sdp-force disable ! mgcp profile default ! ! ! ! ! end ... View more