Site to site vpn with multiple subnets on one network

[ccoombs]

I amhaving issues with getting traffic to pass accross my vpn from a location to our HQ that has multiple subnets.

The 10.0.0.0 traffic is passing fine but not the 151.193.141.0 traffic. Below are the two access list. What am i doing wrong here?

Router 1

access-list 115 permit ip 10.0.0.0 0.255.255.255 10.60.60.0 0.0.0.255

access-list 115 permit ip 151.193.141.0 0.0.0.255 10.60.60.0 0.0.0.255

access-list 115 deny ip 151.193.141.0 0.0.0.255 any

access-list 115 deny ip 10.0.0.0 0.255.255.255 any

access-list 120 deny ip 10.0.0.0 0.255.255.255 10.60.60.0 0.0.0.255

access-list 120 deny ip 151.193.141.0 0.0.0.255 10.60.60.0 0.0.0.255

access-list 120 deny ip 10.0.0.0 0.255.255.255 any

access-list 120 permit ip 151.193.141.0 0.0.0.255 any

Router 2

access-list 115 permit ip 10.60.60.0 0.0.0.255 10.0.0.0 0.255.255.255

access-list 115 permit ip 10.60.60.0 0.0.0.255 151.193.141.0 0.0.0.255

access-list 115 deny ip 10.60.60.0 0.0.0.255 any

access-list 120 deny ip 10.60.60.0 0.0.0.255 10.0.0.0 0.255.255.255

access-list 120 deny ip 10.60.60.0 0.0.0.255 151.193.141.0 0.0.0.255

access-list 120 permit ip 10.60.60.0 0.0.0.255 any

thanks!

[gfullage]

I'm assuming Router1 is the HQ router, and that ACL 115 is your crypto ACL and 120 is your NAT ACL (note that it would have been nice for you to supply this information), in which case there doesn't look to be anything wrong with the ACL's specifically.

If traffic is passing over one tunnel, but not the other, then it's probably a routing issue. Does the remote network (10.60.60.0) have a route to 151.193.141.0 that eventually points to the inside interface of Router2? Or is this traffic being routed to some other destination, in which case it won't work?

Similarly, when you're on the 151.193.141.0 network does the route to 10.60.60.0 eventually point back to the inside of Router1, or is this routed off somewhere else?