Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

Site-to-Site connection over Easy VPN

Hi ,

I have been using easy VPN for a long time, but without split tunneling. Last Monday, I made a change in Easy VPN connection and add split-tunnelling properties. I configured all my access succesfully, but site-to-site VPN tunnels. I added other site internel IP subnet and peer IPs, but still cannot reach.

I want to reach other site over Easy VPN, because I was able to reach before split tunnelling operation.

What should I check , or what else will I do ?


Any help greatly appreciated..


Regards.

Everyone's tags (2)
5 REPLIES

Re: Site-to-Site connection over Easy VPN

Hi,

EzVPN could cause problems with split tunneling if in client mode.

Do you have EzVPN in network or client mode?

To check the Site-to-Site problem can you post the configs?

Federico.

Re: Site-to-Site connection over Easy VPN

Sorry, But I dont have any oppurtunity about using EzVPN , because site-to-site VPN connection links our company to another company. The other company uses Checkpoint for firewall. That's why I cannot use EzVPN tech for this situation.

But I thought that If I added the other company's internal network subnet to split tunnel IPs , It went over the site-to-site tunnel.But it did not.

So I added more like peer IP of other company but it is not still working.

I dont want to change my site-to-site configuration because of other company's  approach of IT problem.

Thanks.

Re: Site-to-Site connection over Easy VPN

Sure, it should work with no problems.

Could you post the configuration from your side?

Federico.

Re: Site-to-Site connection over Easy VPN

here is the config file

sorry about A.B.C.D  I have tried to hide punlic IPs

thanks again

Re: Site-to-Site connection over Easy VPN

Ok,

The Site-to-Site tunnel should be established from the PIX to IP A.B.17.252.

The interesting traffic is the traffic defined in access-list outside_cryptomap_20_1 (from any source to 192.168.5.0/24)

If 192.168.5.0/24 is indeed the network that you're trying to reach, then you should add this statement:

access-list inside_nat0_outbound permit ip any 192.168.5.0 255.255.255.0

This command:

route inside 192.168.5.0 255.255.255.0 172.16.0.2 1

Is sending traffic to 192.168.5.0/24 to the inside, which is incorrect if that's the other site's subnet.

Federico.

1065
Views
0
Helpful
5
Replies
CreatePlease login to create content