Hello,
I have a router that I use to hub of dmvpn, this router has 1 default route that learning from eigrp and some static route to other internet connection (I use it only to vpn connectivity). Now I need setup normal tunnel ipsec site-to-site with Vodafone to keep traffic from internet key with dedicated apn.
I setup it, apply crypto map on interface where I point static route. Inside this tunnel I need go "private address" that my radius assign to internet key and packet to "vodafone client radius". Vodafone client radius has IPs public (not rfc1918), I create ACL that match all this traffic.
My problem is I can receive traffic from vodafone but my packet not match from vpn tunnel. Intact now vodafone try login from internet key, I can see your request on my radius but they see time out, because I send back packet but not goes in tunnel and so stop on my router.
If I see "sh crypto session" I see tunnel UP, if I see "sh crypto ipsec sa peer "peer ip" I see packet in "decap" but I can't see packet in "encap".
this is extract my config:
-----------
!
crypto isakmp policy 20
encr 3des
authentication pre-share
group 2
!
crypto isakmp key pskpassword address xxx.xxx.xxx.240
crypto isakmp key pskpassword address xxx.xxx.xxx.241
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
crypto map VPN 10 ipsec-isakmp
set peer xxx.xxx.xxx.240
set transform-set ESP-3DES-SHA
match address TO-VODAFONE-APN-240
!
crypto map VPN 20 ipsec-isakmp
set peer xxx.xxx.xxx.241
set transform-set ESP-3DES-SHA
match address TO-VODAFONE-APN-241
!
ip access-list extended TO-VODAFONE-APN-240
permit ip any 10.102.100.0 0.0.0.255
permit ip host 192.168.217.12 xxx.xxx.xxx.80 0.0.0.7
ip access-list extended TO-VODAFONE-APN-241
permit ip any 10.102.100.0 0.0.0.255
permit ip host 192.168.217.12 xxx.xxx.xxx.56 0.0.0.7
!
interface PortChannel 2
ip address xxx.xxx.xxx.108 255.255.255.248
crypto map VPN
!
-----------
Thanks in advance for your help.
M.
