VPN Client can't reach router or hosts, but can reach other connected sites.

We have a VPN client configuration on a 2901 router. The client passes authentication and connects fine. When connected, cannot reach the 2901 or any devices directly behind it, BUT can reach routers and hosts that are connected to the same 2901 through site to site connections.
Few notes:
I have added some lines excluding NAT in a few different ways, but does not resolve.
I have switched the RAP rool from 10.96.20.x to 172.21.20.x and can then connect to the local host. Appears to be a routing issue to the 10.x network, but I can't seem to find the solution.
Any help would be greatly appreciated. Here is the config:
boot-start-marker
boot system flash
boot system flash:c2900-universalk9-mz.SPA.153-2.T.bin
no ip domain lookup
ip inspect log drop-pkt
ip inspect name FIREWALL tcp
ip inspect name FIREWALL udp
ip inspect name FIREWALL ftp
ip inspect name FIREWALL fragment maximum 256 timeout 1
ip inspect name FIREWALL ntp
ip inspect name FIREWALL pptp
ip inspect name FIREWALL dns
ip inspect name FIREWALL l2tp
ip inspect name FIREWALL pop3
ip inspect name FIREWALL icmp router-traffic
no ipv6 cef
crypto isakmp policy 1
encr aes
authentication pre-share
group 2
crypto isakmp policy 5
encr 3des
authentication pre-share
group 2
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp policy 95
authentication pre-share
group 2
crypto isakmp policy 99
hash md5
authentication pre-share
group 2
crypto isakmp policy 110
hash md5
authentication pre-share
crypto isakmp client configuration group VPN-RAS
key *********
dns 10.96.17.2 10.1.200.50
wins 10.96.17.2 10.1.200.50
domain mine.com
pool RAPOOL
acl SPLIT
save-password
split-dns mind.com
netmask 255.255.255.0
crypto isakmp profile USERS
   match identity group VPN-RAS
   client authentication list DOMAIN
   isakmp authorization list VPN-RAS
   client configuration address respond
   keepalive 300 retry 5
crypto ipsec transform-set AES128 esp-aes esp-sha-hmac
mode tunnel
crypto ipsec transform-set 3DES esp-3des esp-sha-hmac
mode tunnel
crypto ipsec transform-set DES esp-des esp-md5-hmac
mode tunnel
crypto ipsec transform-set 3DES-MD5 esp-3des esp-md5-hmac
mode tunnel
crypto ipsec transform-set DES-SHA esp-des esp-sha-hmac
mode tunnel
crypto ipsec transform-set myset esp-3des esp-sha-hmac
mode tunnel
crypto dynamic-map dynmap 1
set transform-set AES128
set isakmp-profile USERS
crypto map COMPANY_VPN 10 ipsec-isakmp
set peer *******
set transform-set 3DES-MD5
match address PA-VPN
qos pre-classify
crypto map COMPANY_VPN 50 ipsec-isakmp
set peer ******
set transform-set AES128
match address VPN
qos pre-classify
crypto map COMPANY_VPN 999 ipsec-isakmp dynamic dynmap
interface Embedded-Service-Engine0/0
no ip address
shutdown
interface GigabitEthernet0/0
ip address 37.222.111.224 255.255.255.248
ip access-group INBOUND in
no ip redirects
no ip unreachables
no ip proxy-arp
ip verify unicast reverse-path
ip flow ingress
ip flow egress
ip nat outside
ip inspect FIREWALL out
ip virtual-reassembly in
duplex auto
speed auto
no cdp enable
no mop enabled
crypto map COMPANY_VPN
interface GigabitEthernet0/1
no ip address
ip flow ingress
duplex auto
speed auto
interface GigabitEthernet0/1.17
description LAN
encapsulation dot1Q 17
ip address 10.96.17.253 255.255.255.0
ip access-group OUTBOUND in
ip flow ingress
ip flow egress
ip nat inside
ip virtual-reassembly in
standby 0 ip 10.96.17.254
standby 0 priority 110
standby 0 preempt
standby 0 track 1 decrement 20
interface GigabitEthernet0/1.27
description VOICE
encapsulation dot1Q 27
ip address 192.168.17.254 255.255.255.0
ip access-group OUTBOUND in
ip helper-address 10.96.17.2
ip flow ingress
ip nat inside
ip virtual-reassembly in
h323-gateway voip bind srcaddr 192.168.17.254
ip local pool RAPOOL 10.96.20.50 10.96.20.150
ip forward-protocol nd
ip nat inside source route-map NAT-POOL interface GigabitEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 37.222.111.223
ip route 10.96.16.0 255.255.255.0 10.96.17.250
ip route 172.22.1.0 255.255.255.0 10.96.17.250
ip route 172.22.2.0 255.255.255.0 10.96.17.250
ip route 172.22.3.0 255.255.255.0 10.96.17.250
ip route 192.168.16.0 255.255.255.0 10.96.17.250
ip access-list extended DMZ
deny   ip any 10.0.0.0 0.255.255.255
deny   ip any 192.168.0.0 0.0.255.255
permit ip any any
ip access-list extended GUEST
deny   ip any 10.0.0.0 0.255.255.255
deny   ip any 192.168.0.0 0.0.255.255
permit ip any any
ip access-list extended INBOUND
deny   ip 80.25.124.0 0.0.0.255 any
deny   ip 10.0.0.0 0.255.255.255 any
deny   ip 172.16.0.0 0.15.255.255 any
permit udp host 173.239.147.114 any eq isakmp
permit esp host 173.239.147.114 any
deny   ip 192.168.0.0 0.0.255.255 any
permit udp any host 37.222.111.224 eq isakmp
permit udp any host 37.222.111.224 eq non500-isakmp
permit esp any host 37.222.111.224
ip access-list extended NAT
deny   ip 10.96.20.0 0.0.0.255 any
deny   ip any 10.96.20.0 0.0.0.255
permit ip 192.168.0.0 0.0.255.255 any
permit ip 10.0.0.0 0.255.255.255 any
ip access-list extended NONAT
permit ip any 192.168.0.0 0.0.255.255
permit ip any 10.0.0.0 0.255.255.255
ip access-list extended OUTBOUND
deny   udp any host 22.55.77.106 eq isakmp
deny   udp any host 22.55.77.106 eq non500-isakmp
deny   esp any host 22.55.77.106
permit ip any any
ip access-list extended PA-VPN
permit ip 10.0.0.0 0.255.255.255 10.96.18.0 0.0.0.255
permit ip 10.0.0.0 0.255.255.255 192.168.18.0 0.0.0.255
permit ip 192.168.0.0 0.0.255.255 10.96.18.0 0.0.0.255
permit ip 192.168.0.0 0.0.255.255 192.168.18.0 0.0.0.255
ip access-list extended SPLIT
permit ip 10.0.0.0 0.255.255.255 any
permit ip 192.168.0.0 0.0.255.255 any
ip access-list extended VPN
permit ip 10.96.16.0 0.0.0.255 10.0.0.0 0.255.255.255
permit ip 10.96.17.0 0.0.0.255 10.0.0.0 0.255.255.255
permit ip 10.96.18.0 0.0.0.255 10.0.0.0 0.255.255.255
permit ip 10.96.0.0 0.0.255.255 192.168.0.0 0.0.255.255
permit ip 10.96.0.0 0.0.255.255 10.0.0.0 0.255.255.255
permit ip 192.168.16.0 0.0.0.255 192.168.0.0 0.0.255.255
permit ip 192.168.17.0 0.0.0.255 192.168.0.0 0.0.255.255
permit ip 192.168.18.0 0.0.0.255 192.168.0.0 0.0.255.255
permit ip 192.168.17.0 0.0.0.255 10.0.0.0 0.255.255.255
permit ip 192.168.18.0 0.0.0.255 10.0.0.0 0.255.255.255
permit ip 172.22.0.0 0.0.255.255 10.0.0.0 0.255.255.255
permit ip 172.22.0.0 0.0.255.255 192.168.0.0 0.0.255.255
route-map NAT-POOL deny 5
match ip address NONAT
route-map NAT-POOL permit 10
match ip address NAT

Similar Messages

Can access Apple TV via airplay, but can't get to internet or iMac from Apple TV

Can access Apple TV via airplay, but can't get to internet or iMac from Apple TV. Whenever I try to put my info in it says to try later. When I test network it says network time has not been set. It has worked previously.

Try the following steps, check whether things are working after each step where appropriate, before trying the next.
Check AirPlay is turned on on the Apple TV (turn it off and on if it already is)
Check that both devices are on the same network (Settings > Wifi, on the mobile device and Settings > General > Network, on the Apple TV).
Restart the Apple TV (Settings > General > Restart).
Restart the Apple TV by removing ALL the cables for 30 seconds.
Restart your router. (Also try removing it’s power cord for at least 30 seconds)
Restart your mobile device.
If you are still having problems, the following article(s) may help you.
Troubleshooting AirPlay
Troubleshooting Wi-Fi networks and connections
Recommended Wi-Fi settings
Wifi Diagnostic Software (for Mac users)
You may also find some help on this page, where I’ve collected some of the more unusual solutions to network issues.
When making adjustments to your network for better optimisation, you may find some of the points mentioned on this page helpful.

Why can I not print from pages but can if I copy to text edit, I get "printer off line message " from pages ?

Why can I not print from pages but can if I copy to text edit, I get "printer off line message " from pages ? I use HP wireless printer .

Are you sure you have the right printer?
In UNIX/OSX printers are virtual links to devices and even with the same name can be trying to reach a printer via another network address, so it thinks it is another printer.
Peter

I can sink my music and pictures, but can not get my contacts to sync. any ideas?

i can sync my music and photos, but can't get my contacts to sync? anybody
know how to do this? thanks,

Have you Enable the Media Sharing on your Router setup page? To enable media sharing on your Router login to the router setup page and click on the Storage tab and below click on the sub tab "Media Sharing" and click on "Specify the Folder" and then add the video folder and click on save settings..
Once done now you can try to scan for video folder on your PS3 and check.

Trying to connect my new Apple TV to my Samsung flatscreen TV is blinking menu is there and can be accesed with the remote, but can be seen for one sec.

Trying to connect my new Apple TV to my Samsung flatscreen TV with a Belkin HDMI cable. Screen is blinking menu is there and can be accesed with the remote, but can be seen for one sec.

Changed the cable and its working.

I have downloaded 2 rented movies. I can find then in my downloads but can not find then in iTunes. I read the others that have had the same problem an I can't find the rented in iTunes

I have downloaded 2 rented movies. I can find then in my downloads but can not find then in iTunes. I read the others that have had the same problem an I can't find the rented in iTunes

Hey rangermikegsm,
Welcome to Apple Support Communities.
It sounds like you’re concerned because you don’t see your rentals in iTunes, but they appear to have downloaded. Take a look at the article below and check the Rentals tab in iTunes on your MacBook.
About renting movies from the iTunes Store - Apple Support
Find movies you rented previously
Find your movie on the device you used to rent it.
On a Mac or PC: Go to the Rentals tab in the Movies section of the iTunes Library.
On an iOS device: Go to the Rental tab of the Videos app.
Using Apple TV (2nd or 3rd generation): Look in the top shelf of the main menu.
Ciao,
-Jason

HT1338 I can see my photos in iphoto but can't email them, edit them or print them....help please!

I can see my photos in iphoto but can't email them, edit them or print them....help please!

First, what is the formatting of the external hard drive? It should be OS X Extended (journaled). You can determine it by selecting the EHD and typing Command + i.
Click to view full size
If it isn't formatted to that you should move the library off of it and reformat.
The "!" is an indication that the file path to the original file has been broken So make a temporary, duplicate copy of the library and apply the two fixes below in order as needed:
Fix #1
Launch iPhoto with the Command+Option keys held down and rebuild the library.
Select the options identified in the screenshot.
Fix #2
Using iPhoto Library Manager to Rebuild Your iPhoto Library
Download iPhoto Library Manager and launch.
Click on the Add Library button, navigate to your Home/Pictures folder and select your iPhoto Library folder.
Now that the library is listed in the left hand pane of iPLM, click on your library and go to the File ➙ Rebuild Library menu option
In the next window name the new library and select the location you want it to be placed.
Click on the Create button.
Note: This creates a new library based on the LIbraryData.xml file in the library and will recover Events, Albums, keywords, titles and comments but not books, calendars or slideshows. The original library will be left untouched for further attempts at fixing the problem or in case the rebuilt library is not satisfactory.
OT

HT1365 Hi I have Imac 5 processor and I guess installed Lion I am having difficulty with Wifi connection. Sometimes after shut down number of times still does not access wifi or if it does I can see wifi bar on iMac but can't open any webpage. Please help

Hi everybody,
I have Imac 5 processor and I guess installed Lion I am having difficulty with Wifi connection. Sometimes after shut down number of times still does not access wifi or if it does I can see wifi bar on iMac but can't open any webpage. Please help
Thanks

Hello:
There was an OS X 10.7 update released a month or so ago that fixed this problem. Run software update.
Barry

Laptop is unable to detect my home router wifi network but detecting all other neighbour networks

My pavilion g6 laptop is unable to detect my home router wifi network but detecting all other neighbour networks even my phone network also. The same router network is detecting good in another laptops.

Hi , Welcome to the HP Forums! It is a great place to find answers and information!
For you to have the best experience in the HP forum I would like to direct your attention to the HP Forums Guide. Learn How to Post and More i understand that your notebook finds and displays many network but not yours but another laptop does locate it. One of the easiest steps to try is to reset the router by removing power for approximately 20 seconds and then reconnecting the power. Give the router time to reset and come back up . Does you network now show? If your network is set to 5.0 GHz try changing the setting to mixed mode or 2.4 GHz as that is the best selection for HP notebooks. Here is a link to HP PCs - Troubleshooting Wireless Network and Internet (Windows 8). To say thanks for replying, please click the thumbs up icon below. If this overcame your difficulty please tell people by selecting solution provided to allow it to found with greater ease. Best of Luck!

Hello, trying to download the latest iTunes software version, a pop up comes with a "invalid signature" message. Try to do download only with the same results. I can buy and download from iTunes but can't get the latest version?

Hello, trying to download the latest iTunes software version, a pop up comes with a "invalid signature" message. Try to do download only with the same results. I can buy and download from iTunes but can't get the latest version?

Transfer Purchases = iTunes > File > Transfer Purchases
http://support.apple.com/kb/HT1848

Touchscreen doesn't work. i can slide down to access date but can't unlock

touchscreen doesn't work. i can slide down to access date but can't unlock

http://support.apple.com/kb/ts2802
Try some of the steps in the Display section of the above link.

I can receive mail on my 5S but can't send email. Setting appear correct so what is the issue?

I can receive mail on my 5S but can't send email. Setting appear correct so what is the issue?

Who is the email provider and what settings are you using?

TS3276 I can receive mails on my iphone but can't receive mails on my macbook, what can I do?

I can receive mails on my iphone but can't receive mails on my macbook, what can I do?

Mail – Troubleshoot Send and Receive
Mail Problems
Mail

HT1430 I can get emails on my IPad but can't send them.Help,please.Thanks.

I can get emails on my IPad but can't send them.Help,please.

Did you check the outgoing mail server setting? Make sure that your username and password are in there.
Settings>Mail, Contacts, Calendars>Your email account>Account>Outgoing mail server - tap the server name next to SMTP and check in the primary server and make sure your username and password are entered and correct - even if it says that the password is optional.

My iphone 5 for some reason can receive calls, send & receive texts but can not call out

My iphone 5 for some reason can receive calls, send & receive texts but can not call out

I am not sure if this issue is going to help you but lets give it a try.
I know that where im from, which is the Netherlands, I am not able to sent e-mails from my iPhone or any other mobile device by using 3G or a random WIFI acces point. The provider only allowes you to sent e-mails when you are connected to a network of there own. Which means if you have provider "101" and your email settings are set up for this provider in your iPhone but your using the network of a friend of yours which is provider "202" you cannot sent emails from his network. Though you can receive them you may not sent.
As I said, I am not aware if this issue is the same for you totaly depents on the country and provider your using.

VPN Client can't reach router or hosts, but can reach other connected sites.

Similar Messages

Maybe you are looking for