Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

VPN NAT Issue

Hi,

We have Cisco 2600, IOS 11.3 (T), I have done NATting for my Pvt IPs. We have also done a VPN from our office to one of our remote branches which is terminated on a PIX. For VPN our office is using IPs 192.168.57.0/24 and the Branch is using 92.168.225.0/24. My Linux-DHCP server gives the IPs to the user on startup and assigns the gateway as the secondary router IP address of the serial interface. The users can access the VPN as well as the Internet without any hassles .

Problem is that some of the users in between cant access the VPN or the Internet. But they can reach till the router interface, they can ping both Pub and Pvt(Secondary) IPs of the router Serial Interface, they can everyone in the network except that the cant go beyond the router interface. Upon doing some R&D i find out that after I clear the IP CACHE or CLEAR ARP-CACHE. They can access the VPN and Internet both. But in this also after I clear the cache and if the user makes a query for any VPN related stuff it is not able to access it and not even the Internet but

can reach the router interface. But after clearing the CACHE if it queries for the Internet it works and with that the VPN starts also. This happens frequently with 6-7 users out of 80 users, the rest 70+ have no problems.

Their problem can be solved for sometime like an hour but after an hour they again experience the problem, again I have to clear the cache, ask them to ping any internet address and then it works. The users facing this problem have a constant access to the VPN.

Please suggest me a solution for this.... for any changes if to be done.

TIA

Regards

- Inte

2 REPLIES
Cisco Employee

Re: VPN NAT Issue

do "no ip route-cache" (i.e. Process switching) under all the interfaces in this context.

Hope that helps.

R/Yusuf

Community Member

Re: VPN NAT Issue

11.3 is pretty old code for IPSEC VPN as well.

If it got enough memory and flash, please try to upgrade to 12.1.8C or 12.1.5T8 above.

For above version, normally, you should not need to do "no ip route-cache".

For many old version of IOS, you do need to turn the fast-switch off.

82
Views
0
Helpful
2
Replies
CreatePlease to create content