Site to site VPN routing issue

[toufikzemri]

Hi,

I have site to site VPN from SR520 to SFsence VPN, the tunnel is up but I can't ping internal addresses from both site trace route terminate from my default gateway. Please help

Access list configuration:

access-list 100 permit ip 10.0.43.0 0.0.0.255 10.10.10.0 0.0.0.255

access-list 100 permit ip 10.10.10.0 0.0.0.255 10.0.43.0 0.0.0.255

ip nat inside source route-map NONAT interface Dialer 0 overload

access-list 110 deny ip 10.10.10.0 0.0.0.255 10.0.43.0 0.0.0.255

access-list 110 permit ip 10.10.10.0 0.0.0.255 any

route-map NONAT permit 10

match ip address 110

Note: 10.0.43.0/24 remote site (SFsence)

10.10.10.0/29 local site Cisco SR520 router

[Jennifer Halim]

i assume that acl 100 is your crypto ACL, it should only be the second line, and first line should be removed.

on SR520 router, should only have:

access-list 100 permit ip 10.10.10.0 0.0.0.255 10.0.43.0 0.0.0.255

On SF sense, should only have:

access-list 100 permit ip 10.0.43.0 0.0.0.255 10.10.10.0 0.0.0.255

[toufikzemri]

Thanks Jennifer

I have don it but I end up with the following failure reason from the CCP troubleshooting:

The following source are routed through the crypto map interface:

1)255.255.255.255

2)127.0.0.0

3)10.0.43.0

Recommended action:

Go to configure>routing and correct the routing table.

Any idea?

Sent from Cisco Technical Support iPad App

[Julio Carvajal]

Hello,

Can you share the following information:

     -show ip route

     -show run | sec crypto ( We only need to see the crypto map configuration)

     -show ip interface brief (We will need to check the local LAN Ip range

If there is any access-group applied to any interface please let us know.

Regards,

Julio

[toufikzemri]

Thank you very much for your help the problem was access list denying the traffic it has been solved. Thanks again

Sent from Cisco Technical Support iPad App

[Julio Carvajal · Accepted solution]

Glad to know everything is working now,

please mark the question as answered so future users can learn from this,

Regards,