VPN between Cisco 891 (site A) and 5555x - No internet access

[Steve Coady]

Hello

I have a vpn configured between site A and the Corporate. The VPN is passing data, however users are unable to reach the internet. 

The encryption domain specifies only 10.x.x.x from lan to lan. natting exempt. 

What could be causing this issue? 

[Rahul Govindan]

Could you attach the sanitized config from both sides? If your nat exempt and crypto acls are correct, you should have Internet access at site A through its own ISP.

[Steve Coady]

Rahul

Thank you for the guidance.

please see attached configs

[Rahul Govindan]

Looks like you are missing NAT on your remote device. You would need to create something like given in this doc:

http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/14132-ios-D.html

1) Create an ACL denying traffic between the routers LAN and remote corporate networks. Permit everything else from router LAN at the end of the ACL.

2) Add the ACL in the NAT overload statement

3) Add "ip nat inside/outside" on your LAN and WAN interfaces.