Jon, I'm confused too! Wish I knew more about routers. Anywho, I updated my first post with a little config. All the traffic currently flows over the serial connection. If I want specific traffic to flow over int fa0/1 instead, do I only need the crypto map acl? I don't need to do pbr?

That's my understanding. You've got me second-guessing myself now. I know for sure you don't need a route for VPN's on pix/asa or more specifically you don't need a route to the remote subnet(s) but you do to the remote peer.

As you have a P2P link your 2800 will know how to get to the peer address. Unfortunately i don't have any routers to test with but from memory i think it works the same way.

Edit - if you test and find this doesn't work this link may help - it's the order of operations on a router although i suspect you may have seen it already -

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080133ddd.shtml

Jon

I'll try this out later today and let you know how it goes.

2811

crypto map mymap 1 ipsec-isakmp

description Tunnel to Main Site

set peer 66.x.x.1xx

set transform-set ESP-3DES-MD5

set pfs group2

match address 120

access-list 120 permit ip host 172.24.154.1 host 172.24.157.225

access-list 120 permit ip host 172.24.154.1 host 172.24.157.226

2811#show ip route | inc 157

D 172.24.157.0/24 [90/2172416] via 192.168.10.29, 12:27:45, Serial0/1/0

???

Is the 172.24.157.0 network meant to be reachable via the s0/1/0 link and you only want some of the traffic to go via the ethernet link ?

Jon

Yes.

Your original config had

set ip next-hop 98.x.x.1

but according to this config

set peer 66.x.x.1xx

Is this just a typo ?

Jon

98.x.x.1 is the next hop of interface fa0/1.

66.x.x.1xx is peer address on 7200.

Should I have the next hop be the peer address?

Even if I add a static route it doesn't show up?

ip route 172.24.157.226 255.255.255.255 66.x.x.1xx

Phil_Rtr#show ip route | inc 157

D 172.24.157.0/24 [90/2172416] via 192.168.10.29, 12:44:29, Serial0/1/0

"Should I have the next hop be the peer address?"

No, it's right as it is. I think the issue is as you have highlighted ie. you have a route for the the subnet pointing out a different interface (never done this before) and routing happens before crypto checks. So you could

1) Just add static routes for these 2 hosts on your 2800 so that they get routed to the right interface

OR

2) we can try and work out why PBR isn't working. PBR happens before routing (obviously !!). Let me have a reread of the entire post and see if there are any glaring things i've missed. By the way when you set up the PBR did you see any hits on your access-list ?

Jon

Thanks Jon. I added a little to my last post. I'll check the pbr acl for hits.

Adam

The route would have to be the next-hop out of fa0/1

ip route 172.24.157.226 255.255.255.255 98.x.x.1

By the way, do you have a route to 66.x.x.1xx in your routing table ?

Jon

I don't know, but the vpn comes up.