Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Site to site VPN routing issue

Hi,

I have site to site VPN from SR520 to SFsence VPN, the tunnel is up but I can't ping internal addresses from both site trace route terminate from my default gateway. Please help

Access list configuration:

access-list 100 permit ip 10.0.43.0 0.0.0.255 10.10.10.0 0.0.0.255

access-list 100 permit ip 10.10.10.0 0.0.0.255 10.0.43.0 0.0.0.255

ip nat inside source route-map NONAT interface Dialer 0 overload

access-list 110 deny ip 10.10.10.0 0.0.0.255 10.0.43.0 0.0.0.255

access-list 110 permit ip 10.10.10.0 0.0.0.255 any

route-map NONAT permit 10

match ip address 110

Note: 10.0.43.0/24 remote site (SFsence)

10.10.10.0/29 local site Cisco SR520 router

1 ACCEPTED SOLUTION

Accepted Solutions

Re: Site to site VPN routing issue

Glad to know everything is working now,

please mark the question as answered so future users can learn from this,

Regards,

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
5 REPLIES
Cisco Employee

Site to site VPN routing issue

i assume that acl 100 is your crypto ACL, it should only be the second line, and first line should be removed.

on SR520 router, should only have:

access-list 100 permit ip 10.10.10.0 0.0.0.255 10.0.43.0 0.0.0.255

On SF sense, should only have:

access-list 100 permit ip 10.0.43.0 0.0.0.255 10.10.10.0 0.0.0.255

New Member

Re: Site to site VPN routing issue

Thanks Jennifer

I have don it but I end up with the following failure reason from the CCP troubleshooting:

The following source are routed through the crypto map interface:

1)255.255.255.255

2)127.0.0.0

3)10.0.43.0

Recommended action:

Go to configure>routing and correct the routing table.

Any idea?

Sent from Cisco Technical Support iPad App

Re: Site to site VPN routing issue

Hello,

Can you share the following information:

     -show ip route

     -show run | sec crypto ( We only need to see the crypto map configuration)

     -show ip interface brief (We will need to check the local LAN Ip range

If there is any access-group applied to any interface please let us know.

Regards,

Julio

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
New Member

Re: Site to site VPN routing issue

Thank you very much for your help the problem was access list denying the traffic it has been solved. Thanks again

Sent from Cisco Technical Support iPad App

Re: Site to site VPN routing issue

Glad to know everything is working now,

please mark the question as answered so future users can learn from this,

Regards,

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
404
Views
0
Helpful
5
Replies
CreatePlease to create content