VPN not routing traffic

[csferreira]

Have a Cisco 3005 Concentrator and some users are not able to route traffic due to the gateway not being the same as the VPN interface.  The issue occurred after one of the groups was deleted from the 3005 device.  Users are able to connect but cannot reach the remote network.  When looking at "route print" the gateway shows a different IP address other than the Interface IP of the VPN virtual device.  Is there a way to force a change or clear out routes? Example;

  Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      172.20.10.5    172.20.10.122     20
         10.1.0.0    255.255.255.0      172.20.10.1     172.20.10.59    100
         10.2.0.0    255.255.255.0      172.20.10.1     172.20.10.59    100
     65.216.9.229  255.255.255.255      172.20.10.5    172.20.10.122    100
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      169.254.0.0      255.255.0.0         On-link     172.20.10.122    296
  169.254.255.255  255.255.255.255         On-link     172.20.10.122    276
      172.20.10.0    255.255.255.0         On-link     172.20.10.122    276
      172.20.10.0    255.255.255.0         On-link      172.20.10.59    276
      172.20.10.0    255.255.255.0      172.20.10.1     172.20.10.59    100
      172.20.10.6  255.255.255.255         On-link     172.20.10.122    100
     172.20.10.59  255.255.255.255         On-link      172.20.10.59    276
    172.20.10.122  255.255.255.255         On-link     172.20.10.122    276
    172.20.10.122  255.255.255.255      172.20.10.1     172.20.10.59    276
    172.20.10.255  255.255.255.255         On-link     172.20.10.122    276
    172.20.10.255  255.255.255.255         On-link      172.20.10.59    276
    172.20.10.255  255.255.255.255      172.20.10.1     172.20.10.59    276
      172.20.11.0    255.255.255.0      172.20.10.1     172.20.10.59    100
      172.20.21.0    255.255.255.0      172.20.10.1     172.20.10.59    100
      172.20.31.0    255.255.255.0      172.20.10.1     172.20.10.59    100
      172.20.50.0    255.255.255.0      172.20.10.1     172.20.10.59    100
      172.20.51.0    255.255.255.0      172.20.10.1     172.20.10.59    100

[Herbert Baerten]

Agree with the previous poster, check the backup of the config and compare the group settings.

Also: you say all users are using the same pool, but is it the same pool as before (when everything was working ok) ?

Can you also please get:

- "ipconfig -a" and  "route print" before and after connecting

- client logs at level 15 (make sure the client is not running, edit the vpnclient.ini file, set the log levels to 15, save the file, start the client, do not edit the log levels in the GUI)

[csferreira]

Do not have the original config prior to the group be deleted.  I'm starting to think it's an issue of routing between the VPN Virtual adapter and the NIC since the user can connect and the issue is not widespread but only affecting a few users.  Will get the route print and ipconfig print outs later today and post.

Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.10       20
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      192.168.1.0    255.255.255.0     192.168.1.10    192.168.1.10       20
     192.168.1.10  255.255.255.255        127.0.0.1       127.0.0.1       20
    192.168.1.255  255.255.255.255     192.168.1.10    192.168.1.10       20
        224.0.0.0        240.0.0.0     192.168.1.10    192.168.1.10       20
  255.255.255.255  255.255.255.255     192.168.1.10    192.168.1.10       1
Default Gateway:       192.168.1.1
===========================================================================
Persistent Routes:

Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.10       20
         10.1.0.0    255.255.255.0     172.20.10.62    172.20.10.62       1
         10.2.0.0    255.255.255.0     172.20.10.62    172.20.10.62       1
     65.216.9.229  255.255.255.255      192.168.1.1    192.168.1.10       1
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      172.20.10.0    255.255.255.0     172.20.10.62    172.20.10.62       1
     172.20.10.62  255.255.255.255        127.0.0.1       127.0.0.1       20
      172.20.11.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.21.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.31.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.50.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.51.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.60.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.61.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.70.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.71.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.81.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.91.0    255.255.255.0     172.20.10.62    172.20.10.62       1
   172.20.255.255  255.255.255.255     172.20.10.62    172.20.10.62       20
      192.168.1.0    255.255.255.0     192.168.1.10    192.168.1.10       20
      192.168.1.1  255.255.255.255     192.168.1.10    192.168.1.10       1
     192.168.1.10  255.255.255.255        127.0.0.1       127.0.0.1       20
    192.168.1.255  255.255.255.255     192.168.1.10    192.168.1.10       20
        224.0.0.0        240.0.0.0     172.20.10.62    172.20.10.62       20
        224.0.0.0        240.0.0.0     192.168.1.10    192.168.1.10       20
  255.255.255.255  255.255.255.255     172.20.10.62    172.20.10.62       1
  255.255.255.255  255.255.255.255     192.168.1.10    192.168.1.10       1
Default Gateway:       192.168.1.1
===========================================================================
Persistent Routes:
  None

C:\Documents and Settings\jmcclanahan>route print

[csferreira]

Update: issue was related to NAT-T.  Not sure if something happend when the group was deleted but enabling NAT-T resolved the routing problem for the users who were not able to route traffic.

[slmansfield · Accepted solution]

There are some group settings for NAT-T, so it makes sense that some clients had the problem but others didn't.  Good to know that another cause of a VPN client routing problem could be related to the absence of NAT-T.  I rated your answer.