No connection after configuring VPN into my topology

[ithanvasserman]

My topology contains 3 branches (Clusters) each cluster representing full working network, 2 ISP routers (1 ISP for branch 1 and 2) and a BGP ring (the ISP routers connected to different routers in the BGP ring). The branches could communicate between them with the GRE but after I configured VPN into my CORE routers in branch 1 and 2 I couldn't send ping between them and the GRE tunnels anymore. Help me please I'm on it for more then 2 weeks, I don't know what to do (I rewatched my configurations so many times and I still can't see the issue).

[Flavio Miranda]

@ithanvasserman 

 Share your topology here, let me take a look

Zip the file.

[ithanvasserman]

Here it is.

[Flavio Miranda]

@ithanvasserman 

I managed to make your VPN work but you have routing problem on the routers I highlighted on the picture.

[ithanvasserman]

Thank you so much!!! if you can please explain to me in details what you did in them to make the VPN work please!!!

[ithanvasserman]

I found that you change my VPNTraffic access-list by removing "permit gre host _ host _" from the routers and when I configured them back the traffic stopped. Why is the reason for this?

[Flavio Miranda]

@ithanvasserman 

 Sorry, I was a bit busy.

 There are a few things on the config that I dont get it. But, for VPN you need to have a clear ACL statement permiting only the traffic you want to send on the tunnel.  Sounds like the ACL  you created was not matching the traffic properly.
 I am still working on your project because I did not manage to make it work. I could bring the VPN up but the traffic is not reaching the other site.

[Flavio Miranda]

I got this version where the VPN is UP and the communication between sites is happening. Hope that can help you.

The topology is very complex and any change change break other things.

Be carfully with NAT, it will break the VPN.

For testing purpose, try to NAT one traffic and IPSEC other. Dont try to make the same traffic NATting and IPSECing at the same time.

You can reserve one IP address range to be natted and/or go through the GRE tunnel and a different traffic to be VPN.

You can easelly achive this by change the  IPSEC and NAT Access list, for example

VPN:

10.1.21.0/24

NAT

10.1.23.0/24

Then you just need to change the ACLs

ip access-list extended VPNTraffic

permit ip 10.1.21.0 0.0.0.255 10.2.21.0 0.0.0.255

ip access-list extended TO-NAT-ACL

permit ip 10.1.23.0 0.0.0.255 10.2.23.0 0.0.0.255