Anshul,
That is your problem then. 10.2.2.1 is R1. R4 will expect to receive traffic from 10.2.2.0/24 network over the ipsec tunnel. So your traffic is going over ipsec to vpnc to R1 then on the return path R1 to ASA to R2 to R4. That is your problem. Point a route for 172.16.0.0/16 on R1 to the vpnc and it will start to work. R1 needs to know that to get the 172.16.0.0 network it needs to go through the vpnc. Tyson Scott - CCIE #13513 R&S and Security Technical Instructor - IPexpert, Inc. A Cisco Learning Partner - We Accept Learning Credits! Telephone: +1.810.326.1444 Cell: +1.248.504.7309 Fax: +1.810.454.0130 Mailto: [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> From: Anshul Arora (akarora) [mailto:[EMAIL PROTECTED] Sent: Monday, December 17, 2007 4:20 PM To: Tyson Scott Cc: [email protected] Subject: RE: [OSL | CCIE_Security] Section 14: Task 7.5 (b):Remote Access VPN on R4 Tyson, R1 shouldn't need to go through VPNC although it can ping 10.2.2.5. I wonder why R1 would need to reach 172.16.0.0 network? In this setup I'm treating VPNC as Easy VPN server and R4 as Remote client. I defined the address pool in VPNC to hand in to its clients. But as part of this lab in other scenarios R1 is told to reach switch-1 and R5 only through PIX. Yeah R4 can also ping 10.2.2.5: R4#ping 10.2.2.5 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.2.2.5, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms R4# _____ From: Tyson Scott [mailto:[EMAIL PROTECTED] Sent: Monday, December 17, 2007 12:10 PM To: Anshul Arora (akarora) Cc: [email protected] Subject: RE: [OSL | CCIE_Security] Section 14: Task 7.5 (b):Remote Access VPN on R4 Without reading over the lab does R1 know to go through VPNC to get to 172.16.0.0 network? Can you ping 10.2.2.5? Tyson Scott - CCIE #13513 R&S and Security Technical Instructor - IPexpert, Inc. A Cisco Learning Partner - We Accept Learning Credits! Telephone: +1.810.326.1444 Cell: +1.248.504.7309 Fax: +1.810.454.0130 Mailto: [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> From: Anshul Arora (akarora) [mailto:[EMAIL PROTECTED] Sent: Monday, December 17, 2007 1:43 PM To: Tyson Scott Cc: [email protected] Subject: RE: [OSL | CCIE_Security] Section 14: Task 7.5 (b):Remote Access VPN on R4 Hi Tyson, Thanks for your quick response. R4 & VPN Concentrator have reachability through R4 Serial interface but problem occurs when R4 lookback100 (172.16.0.1) tries to reach Concentrator. Therefore, encryption/decryption also doesn't happen. Attached is the output and configuration files from R4 and R2. Do I need another static on R2 to route 172.16.0.0 network? Appreciate your help, -Anshul _____ From: Tyson Scott [mailto:[EMAIL PROTECTED] Sent: Monday, December 17, 2007 7:03 AM To: Anshul Arora (akarora); [email protected] Subject: RE: [OSL | CCIE_Security] Section 14: Task 7.5 (b):Remote Access VPN on R4 What do the routing tables look like. Have you checked each side to see if there are encryption decryption statistics. Tyson Scott - CCIE #13513 R&S and Security Technical Instructor - IPexpert, Inc. A Cisco Learning Partner - We Accept Learning Credits! Telephone: +1.810.326.1444 Cell: +1.248.504.7309 Fax: +1.810.454.0130 Mailto: [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Anshul Arora (akarora) Sent: Sunday, December 16, 2007 9:20 PM To: [email protected] Subject: [OSL | CCIE_Security] Section 14: Task 7.5 (b):Remote Access VPN on R4 Hi All, I am able to configure Easy VPN server on concentrator. Verified the configuration by connecting test PC as VPN client. Configured R4 as VPN client but ping test failed as captured below. IKE phase-1 and Phase-2 are established (sh output is attached). I'm not sure what is missing? Appreciate any suggestions/pointers. Thanks, -Anshul R4#ping 10.2.2.1 source loopback 100 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.2.2.1, timeout is 2 seconds: Packet sent with a source address of 172.16.0.1 ..... Success rate is 0 percent (0/5) R4: crypto ipsec client ezvpn EZGroup group EZGroup key abcd1234 mode network-extension peer 192.168.5.5 acl 176 username EZUser password ccie1234 xauth userid mode local interface Loopback100 ip address 172.16.0.1 255.255.0.0 ip nat inside crypto ipsec client ezvpn EZGroup inside interface Serial0/0/0 ip nat outside crypto ipsec client ezvpn EZGroup access-list 175 deny ip 172.16.0.0 0.0.255.255 10.2.2.0 0.0.0.255 access-list 175 deny ip 192.168.22.0 0.0.0.255 10.2.2.0 0.0.0.255 access-list 175 permit ip 172.16.0.0 0.0.255.255 any access-list 176 permit ip 172.16.0.0 0.0.255.255 10.2.2.0 0.0.0.255 ip nat inside source list 175 interface Serial0/0/0 overload
