Trying to route all traffic ipsec

[carlo4511]

Hello, 

Can someone please help me with config below. I'm trying to route all traffic (web browsing) through router.

For now I can connect to vpn and browse network but users cannot resolve web pages (endless loading page). If I enable split tunnel web browsing works but this is not what i wont.

lan pool 192.168.10.0/24

local pool 192.168.20.0/24

I assume that this has something with ACL and NAT but I can't figure out what.

Config is attached.

Thanks.

[Philip D'Ath · Accepted solution]

I think your config should work.

What model router is this and what software version are you running?

[carlo4511]

r1#show version
Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(24)T6, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2011 by Cisco Systems, Inc.
Compiled Tue 23-Aug-11 00:41 by prod_rel_team

ROM: System Bootstrap, Version 12.4(13r)T, RELEASE SOFTWARE (fc1)

r1 uptime is 3 days, 1 hour, 28 minutes
System returned to ROM by reload at 07:29:12 UTC Fri May 20 2016
System image file is "flash:c1841-adventerprisek9-mz.124-24.T6.bin"

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

Cisco 1841 (revision 7.0) with 356352K/36864K bytes of memory.
Processor board ID FCZ1351C228
2 FastEthernet interfaces
1 Virtual Private Network (VPN) Module
DRAM configuration is 64 bits wide with parity disabled.
191K bytes of NVRAM.
62720K bytes of ATA CompactFlash (Read/Write)

Configuration register is 0x2102

[Philip D'Ath]

12.4(24)T6 appears to have been withdrawn from download.  Are you able to upgrade to a gold star release like 15.1.4M10?

[carlo4511]

Not a option for now, is there any way to make this work on current sw version ? Do I need to add ip route for vpn traffic, crypo maps ?

Thanks 

[Philip D'Ath · Accepted solution]

I think your config is correct and that you are running into software bug.

[carlo4511]

Can I somehow debug vpn connection ?

[Philip D'Ath]

I don't want to invest any more time into this when I don't think anything is wrong with the config, and that a software upgrade is required.

[carlo4511]

Please look at the output of the windows route print command when I'm connected to vpn through mobile internet.

PS C:\Users\carlo> route print
===========================================================================
Interface List
.......
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 172.20.10.1 172.20.10.2 25
0.0.0.0 0.0.0.0 192.168.20.1 192.168.20.112 21
93.140.228.112 255.255.255.255 172.20.10.1 172.20.10.2 100
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
172.20.10.0 255.255.255.240 On-link 172.20.10.2 281
172.20.10.1 255.255.255.255 On-link 172.20.10.2 100
172.20.10.2 255.255.255.255 On-link 172.20.10.2 281
172.20.10.15 255.255.255.255 On-link 172.20.10.2 281
192.168.20.0 255.255.255.0 On-link 192.168.20.112 276
192.168.20.112 255.255.255.255 On-link 192.168.20.112 276
192.168.20.255 255.255.255.255 On-link 192.168.20.112 276
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 172.20.10.2 281
224.0.0.0 240.0.0.0 On-link 192.168.20.112 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 172.20.10.2 281
255.255.255.255 255.255.255.255 On-link 192.168.20.112 276
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 192.168.20.1 1
===========================================================================

First on the list is provider gateway and persistent route gateway is 192.168.20.1