Site to Site VPN no traffic.

[Shaun McCloud]

Hello,

I have been having an issue with my connection to my vendor, and we can not figure it out for the life of us. We have the tunnel up, we just can not ping either side of it.(as you can tell from the post time, I am at a loss).

The goal is for our site to pass all traffic through to the vendor so they can route it out to the internet through the rest of thier network.

As I said, the tunnel is up, just does not seem to be passsing any traffic, or at least any real traffic, I believe the keep alives are passing.

[Shaun McCloud]

The static nat config was on our router that  handled our T1s, and is no longer in the network path in any way.

Correct me if I am wrong, but the static nats should now be placed on our vendor side external Firewall?

[Jouni Forss]

Hi,

At the moment your sites ASA is configured so that it will perform NAT for all users/hosts on the LAN network. This will in turn mean that all traffic with NAT0 configuration will match the L2L VPN rule and therefore will be forwarded to the L2L VPN connection.

So if the setup is like mentioned above or it is required to be kept that way then it would essentially mean that the public IP address space used on your site before would have to be used on the Vendor sites Internet edge device as you mention.

What I am wondering is if the Vendor site and your site are using the same ISP?

If not then I doubt it that you could move than public IP address space from your site to the Vendor site. It might mean that your servers that are located at your site would need a Static NAT to a new public IP address on the Vendor site.

If on the other hand you would be fine with having these servers traffic through your sites Internet connection then you could perhaps configure the NAT0 so that it WOULD NOT match these servers and these servers would then be Static NATed on your site and would use its connection directly and NOT use the L2L VPN to Vendor site.

- Jouni