Michael,I think there is something else wrong in my config because it is working on your side but not in mine...
Here is my whole config, maybe you will see something...
Thanks again for your time :-)
version 15.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname GVANE01
!
boot-start-marker
boot-end-marker
!
!
logging buffered 51200 warnings
enable secret 4 O8gVxDZkPDpDZ8jTgGXAY2O0eE0ZpmGM6gPQMFkOCaw
enable password xxxxxxxxxx
!
aaa new-model
!
aaa authentication login AuthentVPN local
aaa authorization network AuthorizVPN local
!
aaa session-id common
clock timezone GMT 1 0
clock summer-time GMT recurring
!
ip cef
!
ip dhcp excluded-address 192.168.0.1 192.168.0.99
!
ip dhcp pool DHCP_G
import all
network 192.168.0.0 255.255.255.0
dns-server 192.168.0.254
default-router 192.168.0.254
!
ip dhcp pool DHCP_WIFI_G
import all
network 192.168.2.0 255.255.255.0
dns-server 195.186.1.162 195.186.4.162
default-router 192.168.2.254
!
ip dhcp pool TAVIRA
import all
network 192.168.3.0 255.255.255.0
dns-server 195.186.1.162 195.186.4.162
default-router 192.168.3.254
!
ip domain name GVA.INTRA
ip name-server 195.186.1.162
ip name-server 195.186.4.162
no ipv6 cef
!
multilink bundle-name authenticated
!
vpdn enable
!
vpdn-group Scom
!
template Virtual-Access1
!
crypto pki trustpoint TP-self-signed-98202878
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-98202878
revocation-check none
rsakeypair TP-self-signed-98202878
!
crypto pki certificate chain TP-self-signed-98202878
certificate self-signed 01 nvram:IOS-Self-Sig#1.cer
license udi pid CISCO1921/K9 sn FCZ1724C2ZC
license boot module c1900 technology-package securityk9
!
username xxxx privilege 15 secret 4 xxxxxxxxxxxxxxxx
username xxxxx secret 4 xxxxxxxxxxxxxxx
username xxxxx secret 4 xxxxxxxxxxxxxxxxxxx
!
redundancy
!
crypto isakmp policy 1
encr aes 256
authentication pre-share
group 2
lifetime 3600
!
crypto isakmp client configuration group myVPN
key xxxxxxxxxxxxxxxxxxxx
dns 192.168.0.254
domain GVA.INTRA
pool IPPoolVPN
acl 110
!
crypto ipsec transform-set T1 esp-aes esp-sha-hmac
mode tunnel
!
crypto dynamic-map DynMap 10
set transform-set T1
reverse-route
!
crypto map myMap client authentication list AuthentVPN
crypto map myMap isakmp authorization list AuthorizVPN
crypto map myMap client configuration address respond
crypto map myMap 10 ipsec-isakmp dynamic DynMap
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
no ip address
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
no mop enabled
!
interface GigabitEthernet0/1
description LAN
no ip address
duplex auto
speed auto
no mop enabled
!
interface GigabitEthernet0/1.1
encapsulation dot1Q 1 native
ip address 192.168.0.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1452
!
interface GigabitEthernet0/1.2
encapsulation dot1Q 2
ip address 192.168.1.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1452
!
interface GigabitEthernet0/1.3
encapsulation dot1Q 3
ip address 192.168.2.254 255.255.255.0
ip access-group RESTRICT_WIFI in
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1452
!
interface GigabitEthernet0/1.4
description LAN Tavira
encapsulation dot1Q 4
ip address 192.168.3.254 255.255.255.0
ip access-group RESTRICT_TAVIRA in
ip nat inside
ip virtual-reassembly in
!
interface Dialer1
mtu 1492
ip address negotiated
ip access-group RESTRICT_ENTRY_INTERNET in
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication pap callin
ppp chap hostname xxxxxxxxxxxxxxxxx
ppp chap password 0 xxxxxx
ppp pap sent-username xxxxx password 0 xxxxx
crypto map myMap
!
ip local pool IPPoolVPN 192.168.10.0 192.168.10.100
ip forward-protocol nd
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip dns server
ip dns primary GVA.INTRA soa NS.GVA.INTRA admin@domain.ch 21600 900 7776000 86400
ip nat inside source list 10 interface Dialer1 overload
ip nat inside source list 11 interface Dialer1 overload
ip nat inside source list 20 interface Dialer1 overload
ip nat inside source list 30 interface Dialer1 overload
ip nat inside source list 110 interface Dialer1 overload
ip route 0.0.0.0 0.0.0.0 Dialer1
ip route 192.168.0.0 255.255.255.0 GigabitEthernet0/1.1
ip route 192.168.1.0 255.255.255.0 GigabitEthernet0/1.2
!
ip access-list extended RESTRICT_ENTRY_INTERNET
deny tcp any any eq telnet
deny tcp any any eq 22
deny tcp any any eq www
deny tcp any any eq 443
deny tcp any any eq domain
permit udp any any eq 50
permit ip any any
ip access-list extended RESTRICT_TAVIRA
permit ip any 192.168.0.0 0.0.0.255
deny ip any 192.168.0.0 0.0.0.255
deny ip any 192.168.1.0 0.0.0.255
permit ip any any
ip access-list extended RESTRICT_WIFI
deny ip any 192.168.0.0 0.0.0.255
deny ip any 192.168.1.0 0.0.0.255
permit ip any any
!
dialer-list 1 protocol ip permit
!
!
snmp-server community Greenwich RO
snmp-server community public RO
snmp-server enable traps entity-sensor threshold
access-list 10 permit 192.168.0.0 0.0.0.255
access-list 11 permit 192.168.1.0 0.0.0.255
access-list 20 permit 192.168.2.0 0.0.0.255
access-list 30 permit 192.168.3.0 0.0.0.255
access-list 100 permit ip 192.168.0.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 110 deny ip 192.168.0.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 110 permit ip 192.168.0.0 0.0.0.255 any
!
control-plane
!
line con 0
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
access-class 23 in
privilege level 15
password xxxxxx
transport input telnet ssh
line vty 5 15
access-class 23 in
privilege level 15
password xxxxx
transport input telnet ssh
!
scheduler allocate 20000 1000
ntp update-calendar
ntp server ch.pool.ntp.org
!
end
