Showing results for 
Search instead for 
Did you mean: 

Cisco site-to-site VPN behind non cisco VDSL modem

memmas nanashi


I had a working site-to-site between a Cisco 1841 (ios 12.4) and a cisco 876 router (ios 12.3)...

The problem started when the 876 part upgrade to vdsl so I can't use the 876 to connect so now I'm behind an ISP's vDSL modem...

I follow the tempate at

and have a site-to-site VPN connection, the only problem is while I can ping and access from 876 to 1841 , I can't ping or access (except for the 876) from 1841 to 876...

I would appreciate any help or hint...


EDIT: I don't know if helps but on 876 I'm using double NAT, didn't switch modem to bridge mode, but since it's a tunnel, I don't think it's an issue...

vlan2 taking an IP of range and modem has

here is the result of "sh ip route" is subnetted, 2 subnets

D [90/2818560] via, 01:10:03, Tunnel0

C is directly connected, Tunnel0

C is directly connected, Vlan2

S is directly connected, Tunnel0

C is directly connected, Vlan1

S* [254/0] via

Also when I issue "sh crypto isakmp sa" I get in src the local IP address


dst             src             state          conn-id status  QM_IDLE           2004 ACTIVE

Here is the nat part of 876


crypto map vpnmap1 local-address Vlan2


interface Vlan1

description --- LAN ---

ip address

ip nat inside

ip virtual-reassembly

no ip route-cache cef

no ip route-cache


interface Vlan2

description --- WAN ---

ip address dhcp

ip nat outside

ip virtual-reassembly

no ip route-cache cef

no ip route-cache

crypto map vpnmap1


ip route Tunnel0


ip nat inside source route-map NAT interface Vlan2 overload


route-map NAT permit 10

match ip address PAT

match interface Vlan2


ip access-list extended PAT

deny   ip

permit ip any

permit ip any

permit ip any


Message was edited by: gerasimos_h

2 Replies 2


The 876 initiating would work since it's initiating. It sounds like you have the peer IP address on the 1841 pointing to the modem the 876 is plugged into. If the modem holds the public IP, it's not going to be able to terminate the VPN session from the 1841. Try enabling bridge mode so that the 876 gets a public IP and then re-initiate from the 1841.

Thank you.


Thanks for the answer,

The 876 connects to 1841 to be accurate...

Also I'm trying to avoid bridging the modem, but now I realize that I'm not going to avoid it after all, even after I was so close to the solution...


Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers