So this is where it doesn't make sense to me. From Router A which is 10.2.1.1 I could not ping 10.2.1.3 (the PC). Though from 10.2.2.1 I could ping 10.2.2.2.
_______________________________________________________________________________________________
Router-A#ping 10.2.2.1 source 10.2.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.2.2.1, timeout is 2 seconds:
Packet sent with a source address of 10.2.1.1
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/1 ms
Router-A#sh crypto ipsec sa
interface: GigabitEthernet0/1
Crypto map tag: mymap, local addr 10.10.1.1
protected vrf: (none)
local ident (addr/mask/prot/port): (10.2.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (10.2.2.0/255.255.255.0/0/0)
current_peer 10.10.1.6 port 500
PERMIT, flags={origin_is_acl,ipsec_sa_request_sent}
#pkts encaps: 111, #pkts encrypt: 111, #pkts digest: 111
#pkts decaps: 262, #pkts decrypt: 262, #pkts verify: 262
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 2, #recv errors 0
local crypto endpt.: 10.10.1.1, remote crypto endpt.: 10.10.1.6
path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/1
current outbound spi: 0x57197F43(1461288771)
PFS (Y/N): N, DH group: none
inbound esp sas:
spi: 0xE4F3C728(3841181480)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 2015, flow_id: Onboard VPN:15, sibling_flags 80000046, crypto map: mymap
sa timing: remaining key lifetime (k/sec): (4436291/3594)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x57197F43(1461288771)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 2016, flow_id: Onboard VPN:16, sibling_flags 80000046, crypto map: mymap
sa timing: remaining key lifetime (k/sec): (4436291/3594)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
__________________________________________________________________________________________
Router-B#sh crypto ipsec sa
interface: GigabitEthernet0/1
Crypto map tag: mymap, local addr 10.10.1.6
protected vrf: (none)
local ident (addr/mask/prot/port): (10.2.2.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (10.2.1.0/255.255.255.0/0/0)
current_peer 10.10.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 262, #pkts encrypt: 262, #pkts digest: 262
#pkts decaps: 111, #pkts decrypt: 111, #pkts verify: 111
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 1, #recv errors 0
local crypto endpt.: 10.10.1.6, remote crypto endpt.: 10.10.1.1
path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/1
current outbound spi: 0xE4F3C728(3841181480)
PFS (Y/N): N, DH group: none
inbound esp sas:
spi: 0x57197F43(1461288771)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 2015, flow_id: Onboard VPN:15, sibling_flags 80000046, crypto map: mymap
sa timing: remaining key lifetime (k/sec): (4490813/3557)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xE4F3C728(3841181480)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 2016, flow_id: Onboard VPN:16, sibling_flags 80000046, crypto map: mymap
sa timing: remaining key lifetime (k/sec): (4490813/3557)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
Router-B#
