• A Cisco router (877W), configured for incoming VPN IPSec client connections
  • Some servers, in a network


  • A Linux box with a physical NIC and a vpnc client (tun0/, sent by the Cisco router of Site A), routing is enabled
  • Some workstations, in a network

The problem

While Site B can successfully access the servers of Site A with their LAN address, servers in Site A can only ping the Linux box with his VPN address. They are unable to access the workstations in the LAN.

Cisco router configuration

crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
crypto isakmp client configuration address-pool local dynpool
crypto isakmp client configuration group groupxxx
 key xxxx
 pool dynpool
 acl 105
crypto isakmp profile ciscocp-ike-profile-1
   match identity group groupxxx
   client authentication list ciscocp_vpn_xauth_ml_1
   isakmp authorization list ciscocp_vpn_group_ml_1
   client configuration address respond
   virtual-template 2
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec profile CiscoCP_Profile1
 set transform-set ESP-3DES-SHA
 set isakmp-profile ciscocp-ike-profile-1

access-list 10 permit
access-list 10 permit
access-list 10 permit
access-list 105 permit ip
access-list 105 permit ip

Thanks by advance.



ip route

on the cisco router and see if that works.


And do you have any kind of NAT in the mix?

| improve this answer | |
  • Already tried that, with no success. Yes, there's NAT on the Cisco, some port-forwarding rules and an overload to permit Internet access to servers on Site A. – Laurent Nominé Oct 9 '11 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.