remote access vpn - can only ping inside interface ip, not inside hosts

[tachyon05]

i can ping the inside interface ip address from outside through the vpn, but i cannot ping any internal hosts connected to the inside interface.

i appended a deny ip any any log at the end of the acl, but did not see any icmp being denied.  further more, i do see egress acl of the inside interface allowing icmp echo reply

and yes, inside hosts are configured to respond to pings and rdp requests.

[manish arora]

Check for NAT EXEMPT for the vpn client ip address pool. Post configuration if possible.

manish

[tachyon05]

access-list 122 remark NAT acl
access-list 122 deny   ip 172.16.45.0 0.0.0.255 10.45.10.0 0.0.0.31
access-list 122 permit ip 172.16.45.0 0.0.0.255 any

!
route-map NAT_Bypass permit 1
match ip address 122
!

ip nat inside source route-map NAT_Bypass interface BVI3 overload

!
crypto isakmp client configuration group xxxxx
key xxxxx

pool EZVPN_POOL
!

ip local pool EZVPN_POOL 10.45.10.1 10.45.10.30

if i ping a server connected to the inside interface, i got request timed out and the following acl does not get hit as its count does not increase

access-list 122 deny   ip 172.16.45.0 0.0.0.255 10.45.10.0 0.0.0.31

if i ping the inside interface ip address, the same acl above increases its count and i get replies on my ping

[manish arora]

Post complete configuration & I am hoping that this router is the gateway for the servers right ? also verify there isnt any firewall/ids/iptables dropping packets on the server.

manish

[Jitendriya Athavale]

do you have any firewall on the router like ZBF???

also put an acl in the inbound direction on the inside interface of router for traffic from your internal to vpn pool and see if you get any hit counts on that acl. this will clarify if the reply packets are making it back to the router

so your acl will be something like this

ip access-list extended abc

permit ip

permit ip any any

you should see hit counts when you do show access-list abc

also please paste the output of show crypto ipsec sa

[tachyon05]

it turned out this is a bug on some versions of IOS 15.  in this case it is c180x-advipservicesk9-mz.151-2.T1.bin.

i contacted TAC, and there are 2 ways to fix this.

-- just add the NO IP CEF command

or

-- in the crypto map, instead of just saying reverse-route say reverse-route remote-peer x.x.x.x where the x.x.x.x is the gateway of the router.