Well you can disregard my first statement as you are calling a route-map that doesn't exist. So it shouldn't be doing any nating. I wonder if you removed that statement if you would have any more luck.

no ip nat inside source route-map SDM_RMAP_1 interface FastEthernet0/1  overload

Or if you can't remove that statement maybe you could create a router map SDM-RMAP_1  for your nats that excludes the traffic you want to encrypt using source and destination IPs and permit everything else.

Sorry for the multiple edits to the posts. I'm done.

-Todd

Maybe you could try to add the following to see if it would help:

route-map SDM_RMAP_1 permit 10
match ip address DENY-VPN-TRAFFIC

ip access-list extended DENY-VPN-TRAFFIC
deny ip 10.58.1.0 0.0.0.255 10.31.0.0 0.0.7.255
permit ip any any

-Todd

Todd,

Thank you so very much for your effort to help me,

I have added the lines that you recommended and nothing seems to be changed. I have attached the updated sh running-config for both sites

Site A router:

AA_To_Ply#
AA_To_Ply#ping 10.58.1.10

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.58.1.10, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)  <---Intersting on Site A router I CAN NOT ping the Site B LAN interface but from a client on Site A I can !!!
AA_To_Ply#

Site A: from my desktop

Pinging 10.58.1.10 with 32 bytes of data:
Reply from 10.58.1.10: bytes=32 time=27ms TTL=254
Reply from 10.58.1.10: bytes=32 time=26ms TTL=254
Reply from 10.58.1.10: bytes=32 time=26ms TTL=254
Reply from 10.58.1.10: bytes=32 time=65ms TTL=254

Ping statistics for 10.58.1.10:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 26ms, Maximum = 65ms, Average = 36ms

U:\>tracert 10.58.1.10

Tracing route to 10.58.1.10 over a maximum of 30 hops

  1     1 ms     1 ms     1 ms  10.31.1.1 <---- Main router on Site A
  2     1 ms     1 ms     1 ms  10.31.1.4  <--- Internal Face of the VPN router on Site A
  3    61 ms    60 ms    68 ms  10.58.1.10  <--- Internal Face of the VPN router on Site B

Trace complete.

I can not do any of this on site B

Thank you,

Essi

Essi,

You'll need to mirror your config on Router A like you have for Router B. You don't have natting set up on Router A correctly.You have "ip nat inside" and "ip nat outside" set up on the appropriate interfaces, but you don't have a nat statement to tell the router what to translate.

Try:

ip nat inside source route-map SDM_RMAP_1 interface fa0/1 overload

The reason why you can't ping from router A is that you are not sourcing any traffic that matches your encryption domain. Try pinging and sourcing fa0/0.

-Todd

Now with regard to pinging from Site B to Site A can you do a traceroute from your PC in site Site B to site A. Also can you make sure that you don't have a windows firewall denying ICMP traffic.

Thanks.

-Todd

Also when you are pinging from router Ply-to-Main you may want to check your nat translations to see what if anything is getting translated. Your config looks ok to me, so I'm leaning more to the nat being the issue or something on the hosts. There wouldnt be a firewall or anything between the routers and hosts would there?