Hello,
I am trying to forward IPsec traffic to the internet from my outside interface and I am having difficulty with configuring my router. I confirmed from the tunnel is operational on phase one and phase two and had a device on the opposite end traceroute to an internet address which shows traffic stops on my end of the tunnel. I believe I am not correctly configuring either routing or an ACL. Please see my config below.
crypto map TUNNEL-CMAP 40 ipsec-isakmp
set peer 2.2.2.2
set transform-set TS
match address 172
!
!
!
!
!
interface Tunnel0
ip address 172.31.250.2 255.255.255.252
tunnel source 1.1.1.2
tunnel destination 2.2.2.2
!
!
interface GigabitEthernet0/0
no ip address
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
!
!
interface GigabitEthernet0/2
ip address 1.1.1.2 255.255.255.248
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map TUNNEL-CMAP
!
!
router bgp 11111
no synchronization
bgp log-neighbor-changes
neighbor 172.31.250.1 remote-as 6167
neighbor 172.31.250.1 default-originate
no auto-summary
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip nat inside source list nat interface GigabitEthernet0/2 overload
ip nat inside source route-map nonat interface GigabitEthernet0/2 overload
ip route 0.0.0.0 0.0.0.0 1.1.1.1
!
ip access-list extended nat
permit ip 192.168.100.0 0.0.0.255 any
access-list 172 permit gre host 1.1.1.2 host 2.2.2.2
