Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

No traffic passing through established IPSec tunnel

I stumbled upon a new issue with a newer VPN technology. I have attached a current configuration of my Cisco 871W Router. Here's my dilemma:

I set up my VPN server configuration in the router using the Virtual-Template interface which maps to my VPN Loopback interface (Loopback1). This is the so-called "Enhanced VPN" which no longer maps a crypto policy to the WAN interface. I can successfully connect to the VPN via Cisco VPN Client software v5.0. It passes all stages of IKE, creates the IPSec tunnel and assigns me a specified IP Address from a local pool ( - The that once I have established an IPSec tunnel, I can pass NO traffic. I can't even ping the default gateway ( - Loopback1). I CAN ping the router WAN interface however...FastEthernet4 (which is assigned via DHCP by Comcast). I've tried everything I can think of, but still can't pass any traffic. The debug logs have told me nothing because the tunnel established successfully.

Oh...and on another note, my SSL VPN works just fine. I can establish a full tunnel and pass traffic, telnet, RDP, etc. I just can't do it with a software client installed on a WinXP_SP2 platform.

I think I may have narrowed it down to either NAT or an ACL, but I'm even doubtful of that.

Oh...for reference, I'm running Advanced IP Services 12.4(15)T IOS.

Can anyone help me?



Re: No traffic passing through established IPSec tunnel

Mostly the issue happens to be with Crypto map and access-list. Ensure that the corresponding application ports are opened. Refer URL for more information.

New Member

Re: No traffic passing through established IPSec tunnel

I played with the ACL's and NAT and nothing changed. I removed my 'ip nat inside' command from my Loopback1 interface. SSLVPN still works fine. I'm about ready to give up.

New Member

Re: No traffic passing through established IPSec tunnel

I don't know if it was the version of VPN client ( or some sort of firewall (Norton 360), but I tried on a different computer with the most up-to-date client ( and it works just fine. I tried on the other computer again and traffic doesn't pass at all. So it's a computer error...not a config error!!!

CreatePlease to create content