Hello!
First sorry about my english.
I configured remote access ipsec, without split tunnel on a 2610 router. Everything work fine, the clients can reach the inside network, but sometimes
when i try to reach for example google.com, nothing. I start to ping -t google.com, nothing, but suddenly the client start receiving ping and later nothing again. Maybe PAT ?
My config:
aaa authentication login default local
aaa authentication login VPN_CLIENT_LOGIN local
aaa authentication ppp default local
aaa authorization network default local
aaa authorization network VPN_CLIENT_GROUP local
!
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
!
crypto isakmp client configuration group VPN_CLIENTS_FULL
key *******
dns 172.16.100.129
pool IPSEC
!
!
crypto ipsec transform-set TRANS_3DES_SHA esp-3des esp-sha-hmac
!
crypto dynamic-map EXT_DYNAMIC_MAP 10
set transform-set TRANS_3DES_SHA
reverse-route
!
!
crypto map EXT_MAP client authentication list VPN_CLIENT_LOGIN
crypto map EXT_MAP isakmp authorization list VPN_CLIENT_GROUP
crypto map EXT_MAP client configuration address respond
crypto map EXT_MAP 10 ipsec-isakmp dynamic EXT_DYNAMIC_MAP
!
!
interface Loopback2
ip address 172.16.100.129 255.255.255.224
ip nat inside
!
interface Ethernet0/0
description OUTSIDE_PORT
ip address 172.19.10.2 255.255.0.0
ip nat outside
ip route-cache policy
ip policy route-map ROUTE4IPSEC
full-duplex
no cdp enable
crypto map EXT_MAP
!
ip local pool IPSEC 172.16.100.130 172.16.100.158
ip nat inside source list 101 interface Ethernet0/0 overload
ip nat inside source static tcp 172.16.100.204 80 172.19.10.2 80 route-map nonat extendable
ip nat inside source static tcp 172.16.100.204 14443 172.19.10.2 14443 route-map nonat extendable
!
ip access-list extended NONAT
deny ip 172.16.100.192 0.0.0.31 172.16.100.128 0.0.0.31
permit ip 172.16.100.192 0.0.0.31 any
!
access-list 101 deny ip 172.16.100.32 0.0.0.31 172.16.100.128 0.0.0.31
access-list 101 deny ip 172.16.100.192 0.0.0.31 172.16.100.128 0.0.0.31
access-list 101 permit ip any any
!
access-list 102 permit ip 172.16.100.128 0.0.0.31 any
access-list 102 deny ip any any
!
!
route-map ROUTE4IPSEC permit 10
match ip address 102
set interface Loopback2
!
route-map nonat permit 10
match ip address NONAT
Any idea? Thanks
