Hello,
I am trying to set up a site to site vpn tunneling all traffic through the vpn tunnel to the main site. I have looked at the forum posts many times but apparently too dense to see what is needed. The tunnel comes up and i can pass traffic across the tunnel for the private lan...but internet traffic does not traverse the tunnel. I cant help but think it is a nat issue but do not understand why.
Any help will be appreciated.
here is the relevant configs;
remote site: 871 router
crypto isakmp policy 15
encr aes 256
authentication pre-share
group 2
crypto isakmp key ********* address 207.xx.xx.xx
crypto ipsec transform-set esp-aes esp-aes 256 esp-sha-hmac
crypto map vpn 10 ipsec-isakmp
set peer 207.xx.xx.xx
set transform-set esp-aes
match address VPNTRAFFIC1
ip nat inside source list NONAT interface FastEthernet4 overload
ip access-list extended NONAT
deny ip 192.168.10.0 0.0.0.255 any
ip access-list extended VPNTRAFFIC1
permit ip 192.168.10.0 0.0.0.255 10.0.0.0 0.255.255.255 *if i change this to permit ip 192.168.10.0 0.0.0.255 any then no traffic passes through the tunnel.
interface FastEthernet4
description $ES_WAN$$FW_OUTSIDE$
ip address dhcp
no ip redirects
no ip unreachables
no ip proxy-arp
ip inspect MYFW out
ip nat outside
ip virtual-reassembly
ip route-cache flow
ip tcp adjust-mss 1460
speed 100
full-duplex
no cdp enable
crypto map vpn
!
HQ site: ASA 5510
sysopt permit ipsec command enabled
crypto isakmp policy 15
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ipsec transform-set esp-aes-sha esp-aes-256 esp-sha-hmac
crypto map outside_map 30 match address outside_30_cryptomap
crypto map outside_map 30 set peer 98.xxx.xxx.xxx
crypto map outside_map 30 set transform-set esp-aes-sha
crypto isakmp nat-traversal 20
crypto isakmp ipsec-over-tcp port 10000
crypto isakmp disconnect-notify
tunnel-group 98.xxx.xxx.xxx type ipsec-l2l
tunnel-group 98.xxx.xxx.xxx ipsec-attributes
pre-shared-key *
nat (inside) 0 access-list inside_nat0_outbound
access-list inside_nat0_outbound extended permit ip any 192.168.10.0 255.255.255.0
access-list outside_30_cryptomap extended permit ip any 192.168.10.0 255.255.255.0
