Group, I have a site-to-site VPN tunnel setup. Cisco Pix515 6.34 on both ends.
Both our companies have an internal network scheme of 10.1.20.x
I added the line to my config: static (inside,outside) 10.1.20.151 172.16.2.5 netmask 255.255.255.255
0 0
Everything is grand. We have connectivity.
*NOW* that machine, 10.1.20.151 can't traceroute anything past the tunnel. I think it's trying to send all traffic across the tunnel. what am I doing wrong?
Do i need to do policy routing? if so, can I get an example?
Didn't find your answer? Ask the community — no account required.
T
troute_kilgore
Gang, reading over my post, which was in a hurry, I don't think I was clear on what is going on. I have a site to site vpn set up. I have a machine - 10.1.10.226 that is nat'd to 172.19.1.1. That machine can ping the remote network fine, can ping my network and etc. What it can not do is reach the internet. I think the tunnel is trying to encrypt everything going out from that machine. If I do a tracert, it times out right before the firewall. A traceroute to the remote network is fine. I might be barking up the wrong tree, but I think something with the NAT is messing it up... maybe in the form of routing?
If it helps, here is my relevant config:
nat (inside) 0 access-list 102
crypto map outside_map 209 ipsec-isakmp crypto map outside_map 209 match address outside_cryptomap_209 crypto map outside_map 209 set peer xxx.xxx.xxx.xxx crypto map outside_map 209 set transform-set Triple
access-list outside_cryptomap_209 permit ip host 172.19.1.1 10.23.1
255.255.255.0 access-list outside_cryptomap_209 permit ip host 172.19.1.2 10.23.1.0
255.255.255.0 access-list outside_cryptomap_209 permit ip host 172.19.1.3 10.23.1.0
255.255.255.0 access-list outside_cryptomap_209 permit ip host 172.19.1.4 10.23.1.0
255.255.255.0 access-list outside_cryptomap_209 permit ip host 172.19.1.1
192.168.169.0 255.255.255.0 access-list outside_cryptomap_209 permit ip host 172.19.1.2
192.168.169.0 255.255.255.0 access-list outside_cryptomap_209 permit ip host 172.19.1.3
192.168.169.0 255.255.255.0 access-list outside_cryptomap_209 permit ip host 172.19.1.4
192.168.169.0 255.255.255.0