I have a remote site that has an IPSec tunnel to a our home location. Both sites are using 2620s with the crypto AIM module installed. The remote site is also using NAT for other outbound internet traffic. I have been asked to add a static mapping to the NAT to allow Internet traffic to a server within the remote site. I followed the recommendations in TAC document http://www.cisco.com/warp/customer/707/static.html This seems to allow Internet traffic to the server but it kills any traffic from the server that is supposed to go through the IPSec tunnel to the home office.
Can anyone help me? Below is the config of the remote router
version 12.2
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
!
hostname Remote
!
logging buffered 4096 informational
no logging console
logging monitor notifications
enable secret 5 $1$WL2r$cTrzBqCn2$5iA0omkFBn/1
!
clock timezone CST -6
clock summer-time CDT recurring
ip subnet-zero
!
no ip domain-lookup
!
ip audit notify log
ip audit po max-events 100
!
crypto isakmp policy 1
encr 3des
authentication pre-share
lifetime 39600
crypto isakmp key Mycryptokey address 111.231.129.6
!
!
crypto ipsec transform-set transform1 ah-sha-hmac esp-3des
!
crypto map cryptomap 1 ipsec-isakmp
set peer 111.231.129.6
set transform-set transform1
match address 100
!
call rsvp-sync
!
interface Loopback0
ip address 1.1.1.1 255.255.255.0
!
interface FastEthernet0/0
ip address 10.1.2.1 255.255.255.0
ip nat inside
ip route-cache policy
no ip mroute-cache
ip policy route-map nonat
duplex auto
speed auto
no cdp enable
!
interface Serial0/0
ip address 112.81.92.242 255.255.255.252
no ip redirects
ip nat outside
no ip route-cache
no ip mroute-cache
service-module t1 remote-alarm-enable
no cdp enable
crypto map cryptomap1
!
ip nat pool natpool-1 111.163.213.225 111.163.213.225 netmask 255.255.255.248
ip nat inside source list 110 pool natpool-1 overload
ip nat inside source static 10.1.2.11 111.163.213.226 extendable
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0/0
no ip http server
!
logging trap warnings
logging source-interface FastEthernet0/0
access-list 15 permit 10.1.1.0 0.0.0.255
access-list 15 permit 10.1.2.0 0.0.0.255
access-list 15 deny any log
! access list for IPsec tunnel
access-list 100 permit ip 10.1.2.0 0.0.0.255 10.1.1.0 0.0.0.255
access-list 100 deny ip 10.1.2.0 0.0.0.255 any
! access list for NAT
access-list 110 deny ip 10.1.2.0 0.0.0.255 10.1.1.0 0.0.0.255
access-list 110 deny ip host 10.1.2.11 any
access-list 110 permit ip 10.1.2.0 0.0.0.255 any
! access list for loopback
access-list 112 permit ip host 10.1.2.11 10.1.1.0 0.0.0.255
no cdp run
route-map nonat permit 10
match ip address 112
set ip next-hop 1.1.1.2
!
dial-peer cor custom
!
line con 0
exec-timeout 0 0
password 7 010112054F06055C
login
line aux 0
line vty 0 4
access-class 15 in
exec-timeout 15 0
password 7 131153131F010779
login
!
ntp server 10.1.2.11
end
