I just got done with the exact same problem, and the fix was not obscure, but brain rattling until we figured it out. I'm making the presumption that this is a vpn client pc connecting to the edge router? The attached config is just such a sample that doesn't exist on TAC. The main problem is that the vpn configs, while correct, doesn't say that any existing NAT statements for the inside to outside must be first removed _before_ using the sample config! There can be only _one_ NAT statement for inside addresses headed to the outside, and it is this part of the config that uses the nonat route map.
Take a look at this config, and let me know if you still have questions. My TAC engineer told me that this config might wind up as a new TAC-tested config, it works perfectly for any PC.
-Jeff
----------------------------------------------------------------
username testvpn password 12345
!
ip subnet-zero
!
crypto isakmp policy 3
encr 3des
authentication pre-share
group 2
lifetime 3600
!
crypto isakmp client configuration group mygroup
key mykey
dns 192.168.1.5
wins 192.168.1.5
domain mydomain.net
pool ipsec-pool
!
!
crypto ipsec transform-set bciset esp-3des esp-sha-hmac
!
crypto dynamic-map dynmap 10
set transform-set myset
!
!
crypto map clientmap client authentication list userauthen
crypto map clientmap isakmp authorization list groupauthor
crypto map clientmap client configuration address respond
crypto map clientmap 10 ipsec-isakmp dynamic dynmap
!
!
interface Ethernet0/0
description Connected to Cisco 2924 Port 24
ip address 192.168.1.100 255.255.255.0
ip nat inside
half-duplex
!
interface Ethernet0/1
description Outside public interface
ip address dhcp
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
no ip route-cache
no ip mroute-cache
half-duplex
no cdp enable
crypto map clientmap
!
router ospf 1
log-adjacency-changes
redistribute connected subnets
redistribute static subnets
network 10.0.0.0 0.255.255.255 area 0.0.0.0
network 172.16.0.0 0.0.31.255 area 0.0.0.0
network 192.168.0.0 0.0.255.255 area 0.0.0.0
default-information originate
!
ip local pool ipsec-pool 192.168.0.50 192.168.0.75
!
ip nat inside source route-map nonat interface Ethernet0/1 overload
!
!
access-list 191 deny ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 191 permit ip 192.168.1.0 0.0.0.255 any
!
route-map nonat permit 10
match ip address 191
!
