ipsec site to site failing to work cisco 8200l router

[clovisug]

Am trying to configure ipsec VPN on 8200l router but it is failing.

am doing NAT for the encrypted domain and the same configuration is working on 1142 router

Kindly advise if there is any extra configuration required to be done on the 8200l router model for the vpn to work

[MHM Cisco World]

Sorry are remote-lan and interface subnet same ??

[clovisug]

Sorry are remote-lan and interface subnet same ??...what do u mean by that sir

[clovisug]

Hello am still waiting for your guidance regarding the final configuration that i have used on the router but still traffic is not traversing...kindly advise where the issue could be

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/14132-ios-D.html

This can help you

[clovisug]

this is to do with Remote access and it has no element of NAT i the ipsec configuration

[MHM Cisco World]

You make all subnet x.x.x.x or y.y.y.y 
so I use local and remote LAN 
crypto map SDM_CMAP_1 4 ipsec-isakmp
description Tunnel to PEERTEST
set peer PEERTEST-IP
set transform-set ESP-AES-256-SET
set pfs group5
match address TESTTRAFFIC

ip nat inside source list TESTTRAFFIC-NONAT interface GigabitEthernet0/0/0 overload
ip access-list extended TESTTRAFFIC
10 permit ip host LOCAL-LAN host REMOTE-LAN1
20 permit ip host LOCAL-LAN host REMOTE-LAN2
ip access-list extended TESTTRAFFIC-NONAT
10 deny ip host LOCAL-LAN host REMOTE-LAN1
20 deny ip host LOCAL-LAN host REMOTE-LAN2
30 permit ip any any

ip route REMOTE-LAN1 255.255.255.255 <interface you config crypto under it>
ip route REMOTE-LAN2 255.255.255.255 < interface you config crypto under it>

[clovisug]

Okay i will test it and show if it works out

[MHM Cisco World]

And you are so so welcome 

[clovisug]

when i use the IP of interface you config crypto under it> i get error invalid next hop address (its this router)

[MHM Cisco World]

I correct it check again 
ip route REMOTE-LAN1 255.255.255.255 <interface you config crypto under it>
ip route REMOTE-LAN2 255.255.255.255 < interface you config crypto under it>