All,
Thanks for the replies.
I have resolved the issue, It was the returning traffic was being NAT'ed. When i PING any inside host I used to get reply from the outside interface/public IP and when I look at the "ip nat trans" table it was being NAT'ed. Amending the NAT access-list did not help on the router. Its such a blessing on the ASA with "NAT(0)" in this regard.
I created a loopback interface and a route-map. Route map routes the selective VPN traffic from inside to loopback and then normal routing from loopback to outside hence overcoming the NAT thing. This works for me.
Do you guys have any other way of doing this???
Config below:
!
crypto isakmp policy 3
encr 3des
hash md5
authentication pre-share
group 2
!
crypto isakmp client configuration group xxx
key xxxx
dns 172.19.2.2
wins 172.19.2.2
domain xxxx
pool ippool
acl split
include-local-lan
netmask 255.255.255.0
!
!
crypto ipsec transform-set myset esp-3des esp-md5-hmac
!
!
!
crypto ipsec client ezvpn EASYVPN
connect auto
group cluttons-easy-vpn key xxxx
mode network-extension
peer xxx
xauth userid mode interactive
!
!
crypto dynamic-map dynmap 10
set transform-set myset
reverse-route
!
!
crypto map clientmap client authentication list userauthen
crypto map clientmap isakmp authorization list groupauthor
crypto map clientmap client configuration address respond
crypto map clientmap 10 ipsec-isakmp dynamic dynmap
!
!
!
interface Loopback0
ip address 192.168.254.254 255.255.255.252
!
interface FastEthernet0/0
ip address 172.19.2.254 255.255.255.0
ip nat inside
ip virtual-reassembly
ip policy route-map map-vpn
duplex auto
speed auto
crypto ipsec client ezvpn EASYVPN inside
!
interface FastEthernet0/1
description $ES_LAN$
no ip address
shutdown
duplex auto
speed auto
!
interface ATM0/0/0
no ip address
no atm ilmi-keepalive
dsl operating-mode auto
pvc 0/50
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
!
interface Dialer1
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
ppp chap hostname
ppp chap password 7
ppp pap sent-username
crypto map clientmap
crypto ipsec client ezvpn EASYVPN
!
ip local pool ippool 10.10.1.1 10.10.1.100
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer1
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 600 life 86400 requests 10000
ip nat inside source list 110 interface Dialer1 overload
!
ip access-list extended split
permit ip 172.19.2.0 0.0.0.255 10.10.1.0 0.0.0.255
permit ip 10.10.1.0 0.0.0.255 172.19.2.0 0.0.0.255
!
access-list 1 permit 172.0.0.0 0.255.255.255
access-list 10 permit 172.16.0.4
access-list 11 permit 172.16.0.45
access-list 110 deny ip any 10.10.1.0 0.0.0.255
access-list 110 permit ip any any
access-list 120 permit ip 172.19.2.0 0.0.0.255 10.10.1.0 0.0.0.255
access-list 120 deny ip any any
route-map map-vpn permit 10
match ip address 120
set ip next-hop 192.168.254.253
!
!
Thanks
Mohammed
