I recently performed a simple IP migration on a home network using a Cisco 2621XM acting as the edge/vpn server. I am able to VPN in to the router, obtain an IP from the pool, and I’ve verified phase 1 and 2 matured on the router. However, I can not ping anything on the LAN. I think the problem is with NAT. There are no firewall/AV issues. Note: Previous to the IP migration, the VPN was functioning properly with unimpeded remote connectivity. I have not changed the VPN config and believe me, I have relentlessly checked all addressing on the network.
Reference the VPN config:
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp invalid-spi-recovery
crypto isakmp keepalive 15
!
crypto isakmp client configuration group lee
key I2n801@0
dns 172.16.101.130
domain xxx
pool lee_vpn
acl 150
max-users 3
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
crypto dynamic-map lee_dynmap 1
set security-association lifetime seconds 21600
set transform-set ESP-3DES-SHA
reverse-route
!
!
crypto map lee_dynmap_1 client authentication list userauthen
crypto map lee_dynmap_1 isakmp authorization list lee
crypto map lee_dynmap_1 client configuration address respond
crypto map lee_dynmap_1 65535 ipsec-isakmp dynamic lee_dynmap
The LAN I VPN in to can be summarized into 172.16.101.0/24 with the VPN pool being 172.16.104.0/24.
I believe the issue may be with the NAT ACL I am using:
ip nat inside source list nat-overload interface FastEthernet0/1 overload
ip access-list extended nat-overload
deny ip 172.16.101.0 0.0.0.255 172.16.104.0 0.0.0.255
permit ip 172.16.101.0 0.0.0.255 any
I’ve tried blocking the LAN network from natting to the VPN pool and vice versa, but I am still unable to ping or access anything when VPN’d in. When I am physically connected to the LAN, everything is reachable as expected. Any ideas? All constructive comments are greatly appreciated.