hi federco,

yes my tunnel is established, when i remove the access-list 105 i can ping easely both ways,but i wanted to allowed pings only when am connected via ipsec tunnel.

but it s not working 

You can add:

access-list 105 permit icmp 192.168.1.0 0.0.0.7 any echo

interface fas 0/0
ip access-group 105 in

The above configuration will only allow PING when coming from 192.168.1.x (which is the VPN pool)
Note: Everything else will be blocked

Federico.

thanx federico  , i ll try it now and i ll tell you the result

it didn t work at first but i tried this config this morning and it work perfectly

i can t ping if am not connected via the tunnel, and i can when am connected.My local (inside) machine can t ping the the address of the outsid machine 10.10.10.20 but it can ping its nated address 192.168.1.x

access-list 105 permit icmp 192.168.1.0 0.0.0.255 10.125.20.0 0.0.0.255 echo

access-list 105 permit icmp 192.168.1.0 0.0.0.255 10.125.20.0 0.0.0.255 echo-replay

access-list 105 deny any any

inf f0/1

in access-group 105 out

thank you federico if you have any remarks i hope you 'll tell me .

bye.

Hi there :-)

So it is working now?

Just one thing...

You say that from the VPN client you can PING the NATed IP? Normally you will PING the real IP through the tunnel.

Check if traffic is flowing through the tunnel with the command:  sh cry ips sa

This will show you if packets are getting encrypted/decrypted everytime you attempt to connect.

If it's not working as intended, please share your current configuration.

Federico.

hi ,
i cheked it and that's what i got

Router#sh cry isa sa
dst             src             state          conn-id slot status
10.10.10.1      10.10.10.20     QM_IDLE              1    0 ACTIVE

Router#sh cry cry sa
interface: FastEthernet0/0
    Crypto map tag: clientmap, local addr 10.10.10.1

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.1.4/255.255.255.255/0/0)
   current_peer 10.10.10.20 port 2719
     PERMIT, flags={}
    #pkts encaps: 12, #pkts encrypt: 12, #pkts digest: 12
    #pkts decaps: 12, #pkts decrypt: 12, #pkts verify: 12
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 10.10.10.1, remote crypto endpt.: 10.10.10.20
     path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0
     current outbound spi: 0xAD279339(2905051961)

     inbound esp sas:
      spi: 0xE4C57A5B(3838147163)
        transform: esp-3des esp-md5-hmac ,
   in use settings ={Tunnel, }
        conn id: 3001, flow_id: FPGA:1, crypto map: clientmap
        sa timing: remaining key lifetime (k/sec): (4530874/3365)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0xAD279339(2905051961)
        transform: esp-3des esp-md5-hmac ,
        in use settings ={Tunnel, }
        conn id: 3002, flow_id: FPGA:2, crypto map: clientmap
        sa timing: remaining key lifetime (k/sec): (4530874/3289)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE

     outbound ah sas:
     outbound pcp sas:

so i think it s working,or am i wrong ? 

Phase 1 is up and phase 2 is passing traffic both ways (encrypting and decrypting packets).

Accoding to the outputs everything seems fine... are you having any problems?

Cheers,

Federico.

hi federico ,

now every thing is fine,it s just because uo told me :

so i wanted you to see that it works,that s it.

now am gona try with pix, but i don t have it now so am gonna try it on packet tracer or GNS3 but i don t have its IOS, so if you could help me ,that would be great.

thanks .

cheers

Salwaya,

I cannot actually send you a PIX image here, but remember that everything is on the web.

If you have any further questions let us know  :-)

Federico.

hi federico,

thanks alot,don't worry i ll have more questions to ask .now i ll be looking for IOS .

write you soon .

bye