Here it is, thanks for looking at it for me!

Jon,

Thanks for the info. I think I'm getting closer to figuring this out. I did not setup this router (and have precious little experience with IOS). Usually I just add/change some internet server NAT entries...

I do have a follow up question though...

When this router was ORIGINALLY setup, it routed through the Tunnel with our own private addresses. But due to a conflict with another agency, we are now NATing from 192.168.1 to 192.168.4. But I need to statically assign each machine to a particular address, which the person did not do when configuring the router.

When he recently setup for NAT on the tunnel, he had the following:

ip nat pool tunnel-pool 192.168.4.2 192.168.4.99 netmask 255.255.255.0

ip nat inside source list 110 interface Dialer1 overload

ip nat inside source route-map tpi pool tunnel-pool

Interestingly, with the crypto access-list and the route-map definitions as-is, this worked fine for some reason, the overloaded NAT is used when I hit the internet, and the pooled NAT was used when I hit one of the three private networks listed. But I need to statically assign the NAT addresses, not use a pool, so I expected the static NAT to work when I replaced the pool with the individual NAT statements specifying route-map tpi...

So, my question is this: Using the static NATs as in the previously attached configuration, could I simply change from

route-map tpi permit 10

match ip address 110

To:

route-map tpi permit 10

match ip address 112

?

I'm sure you've nailed where the trouble is. I'm still unsure how to fix it though...

Perhaps you could tell me how to properly setup the crypto, access lists, and route-maps to enable the Tunnel to NAT using one route-map with the commands like:

ip nat inside source static 192.168.1.5 192.168.4.5 route-map tpi

and the overload NAT to work by default for everything else...

Unfortunately it is a production router, and I cannot easily "experiment" with it. Any additional help would be most appreciated!

Hi

I understand your reluctance to experiment on a production router. Any changes suggested should be done out of hours just in case.

That said the easy fix would be to remove the first entry in your route-map. So at present your route-map says

route-map tpi permit 10

match ip address 110

!

route-map tpi permit 20

match ip address 111

the problem line is the first entry. Remove the entry

route-map tpi permit 10

match ip address 110

so you should just have the second entry left.

HTH, let me know how it goes

Jon

Well, it took a while... I mistakenly thought that performing a "copy ftp run" would REPLACE the configuration. In the end, I undid things, did them right, performed the "write mem" and suddenly it worked... The only problem I have now is that UDP messages from the other side of the tunnel are not arriving at my client for some reason. The UDP didn't work with the pool, either, perhaps it is a problem on the other router... TCP works both ways, pings work both ways. Not sure why the UDP is failing... Here is the configuration now...

Thanks again for the help!

My mistake on the UDP, it is all set, thanks again.