I tried this in place for the access list 100, is that what you meant? too deny any of the 192.168.24.0 network from being translated. Unfortunently this did not work either if thats what you were looking for me to do.
access-list 100 deny ip 192.168.24.0 0.0.0.255 any
access-list 100 permit ip 192.168.2.0 0.0.0.255 any
Crypto isakmp sa output:
ASA
Type : L2L Role : initiator
Rekey : no State : MM_ACTIVE
Router
dst src state conn-id status
(Local WAN) (ASA WAN) QM_IDLE 2003 ACTIVE
Crypto IPSEC sa output:
Router
interface: FastEthernet4
Crypto map tag: KentonMap, local addr (LOCAL WAN)
protected vrf: (none)
local ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.24.0/255.255.255.0/0/0)
current_peer (ASA WAN) port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 302768, #pkts decrypt: 302768, #pkts verify: 302768
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: (LOCAL WAN), remote crypto endpt.: (ASA WAN)
path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet4
current outbound spi: 0x3DDF82D1(1038058193)
PFS (Y/N): N, DH group: none
inbound esp sas:
spi: 0x47DA7072(1205497970)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 55, flow_id: Onboard VPN:55, sibling_flags 80000046, crypto map: KentonMap
sa timing: remaining key lifetime (k/sec): (4602390/1551)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x3DDF82D1(1038058193)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 56, flow_id: Onboard VPN:56, sibling_flags 80000046, crypto map: KentonMap
sa timing: remaining key lifetime (k/sec): (4602433/1551)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
ASA
interface: outside
Crypto map tag: LimaMap, seq num: 1, local addr: (LOCAL WAN)
access-list LimatoKenton extended permit ip 192.168.24.0 255.255.255.0 192 .168.2.0 255.255.255.0
local ident (addr/mask/prot/port): (192.168.24.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
current_peer: (ROUTER WAN)
#pkts encaps: 394, #pkts encrypt: 394, #pkts digest: 394
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 394, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: (LOCAL WAN), remote crypto endpt.: (ROUTER WAN)
path mtu 1500, ipsec overhead 58, media mtu 1500
current outbound spi: 47DA7072
current inbound spi : 3DDF82D1
inbound esp sas:
spi: 0x3DDF82D1 (1038058193)
transform: esp-3des esp-sha-hmac no compression
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 1638400, crypto-map: LimaMap
sa timing: remaining key lifetime (kB/sec): (4374000/1342)
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
outbound esp sas:
spi: 0x47DA7072 (1205497970)
transform: esp-3des esp-sha-hmac no compression
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 1638400, crypto-map: LimaMap
sa timing: remaining key lifetime (kB/sec): (4373976/1342)
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
