Ask Question Forum:
C
O
M
P
U
T
E
R
2
8
- Underline
- Bold
- Italic
- Indent
- Step
- Bullet
- Quote
- Cut
- Copy
- Paste
- Table
- Spelling
- Find & Replace
- Undo
- Redo
- Link
- Attach
- Clear
- Code
Y-position of the mouse cursor
Attachment:===
VPN Tunnel Traffic not passing

I have a Cisco 861 router configured with a site-to-site vpn to a Linksys WRV210. The connection has worked in the passed without issue until recently. The location that has the VPN connection had other vendors come in to update other systems and I believe somehow has affected the VPN. Not fully understanding how or what it takes to troubleshoot this type of service (IPSec VPN) I loaded the 861 with a backup config. After the reload the VPN does connect but does not seem to be passing data correctly.
When I traceroute from the 861 the traffic is going through the public/WAN interface and not over the VPN tunnel.
I have not messed with the Linksys WRV210 much because it's pretty much a no brainier. However, if you feel the issue could be there I am happy to provide config and info for that device.
Cisco 861 local network: 192.168.1.0:/24
Linksys WRV210 local network: 192.168.2.0/24
Thanks for any help and let me know if you need more information to help troubleshoot this.
!version 15.1no service padservice tcp-keepalives-inservice tcp-keepalives-outservice timestamps debug datetime msec localtime show-timezoneservice timestamps log datetime msec localtime show-timezoneservice password-encryptionservice sequence-numbers!hostname santo-861!boot-start-markerboot-end-marker!logging buffered 51200logging console criticalenable secret 5 *REMOVED*!no aaa new-modelmemory-size iomem 10clock timezone PCTime -5!crypto pki trustpoint TP-self-signed-3248388390 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-3248388390 revocation-check none rsakeypair TP-self-signed-3248388390!!crypto pki certificate chain TP-self-signed-3248388390 *REMOVED* quitno ip source-route!!ip dhcp excluded-address 192.168.1.1 192.168.1.79ip dhcp excluded-address 192.168.1.120 192.168.1.254!ip dhcp pool main-pool network 192.168.1.0 255.255.255.0 default-router 192.168.1.254 dns-server 192.168.1.254 4.2.2.2 lease 0 12!!ip cefno ip bootp serverip domain name *REMOVED*ip name-server 192.168.1.254ip name-server 4.2.2.2!!license udi pid CISCO861-K9 sn FTX1337Y2C2!!username *REMVOED* privilege 15 secret 5 *REMOVED*!!ip tcp synwait-time 10ip ssh time-out 60ip ssh authentication-retries 2!!crypto isakmp policy 1 encr 3des authentication pre-share group 2crypto isakmp key *REMOVED* address *REMOVED*!!crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac!crypto map SDM_CMAP_1 1 ipsec-isakmp description Tunnel to *REMOVED* set peer *REMOVED* set transform-set ESP-3DES-SHA match address VPN!!!!!interface FastEthernet0!interface FastEthernet1!interface FastEthernet2!interface FastEthernet3!interface FastEthernet4 ip address *REMOVED* 255.255.255.248 ip nat outside ip virtual-reassembly duplex auto speed auto crypto map SDM_CMAP_1!interface Vlan1 ip address 192.168.1.254 255.255.255.0 ip nat inside ip virtual-reassembly ip tcp adjust-mss 1452!ip default-gateway *REMOVED*ip forward-protocol ndip http serverip http authentication localip http secure-serverip http timeout-policy idle 60 life 86400 requests 10000!ip nat inside source static tcp 192.168.1.20 2368 interface FastEthernet4 2368ip nat inside source static tcp 192.168.1.20 61002 interface FastEthernet4 61002ip nat inside source static tcp 192.168.1.20 61031 interface FastEthernet4 61031ip nat inside source static udp 192.168.1.20 61031 interface FastEthernet4 61031ip nat inside source static tcp 192.168.1.20 6320 interface FastEthernet4 6320ip nat inside source route-map SDM_RMAP_1 interface FastEthernet4 overloadip nat inside source static tcp 192.168.1.242 80 *REMOVED* 80 extendableip nat inside source static tcp 192.168.1.242 8080 *REMOVED* 8080 extendableip nat inside source static tcp 192.168.1.242 8081 *REMOVED* 8081 extendableip nat inside source static tcp 192.168.1.243 80 *REMOVED* 80 extendableip nat inside source static tcp 192.168.1.243 1159 *REMOVED* 1159 extendableip nat inside source static tcp 192.168.1.243 1160 *REMOVED* 1160 extendableip nat inside source static tcp 192.168.1.244 80 *REMOVED* 80 extendableip nat inside source static tcp 192.168.1.244 8080 *REMOVED* 8080 extendableip nat inside source static tcp 192.168.1.244 8081 *REMOVED* 8081 extendableip route 0.0.0.0 0.0.0.0 *REMOVED*!ip access-list extended VPN remark CCP_ACL Category=4 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255!logging trap debuggingaccess-list 1 remark CCP_ACL Category=16access-list 1 permit 192.168.1.0 0.0.0.255access-list 100 remark CCP_ACL Category=2access-list 100 deny ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255access-list 100 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255access-list 100 permit ip 192.168.1.0 0.0.0.255 anyno cdp runroute-map SDM_RMAP_1 permit 1 match ip address 100!!control-plane!!line con 0 logging synchronous login local no modem enable transport output telnetline aux 0 login local transport output telnetline vty 0 4 privilege level 15 login local transport input telnet ssh!end
1:2:3:4:5:6:7:8:9:10:11:12:13:14:15:16:17:18:19:20:21:22:23:24:25:26:27:28:29:30:31:32:33:34:35:36:37:38:39:40:41:42:43:44:45:46:47:48:49:50:51:52:53:54:55:56:57:58:59:60:61:62:63:64:65:66:67:68:69:70:71:72:73:74:75:76:77:78:79:80:81:82:83:84:85:86:87:88:89:90:91:92:93:94:95:96:97:98:99:100:101:102:103:104:105:106:107:108:109:110:111:112:113:114:115:116:117:118:119:120:121:122:123:124:125:126:127:128:129:130:131:132:133:134:135:136:137:138:139:140:141:142:143:144:145:146:147:148:149:150:151:152:153:154:155:156:157:158:159:160:161:162:163:164:
Hmm, thanks for the reply but I don't think it is correct to move the issue to the service provider. I am almost positive the issue has something to do with the configuration or function of one of or both routers I have. I just find it very unlikely the two service providers I have could cause VPN traffic not to route correctly but still allow the connection to be made.
Like I stated before, if i do a traceroute from the 861 to the LAN IP of the WRV210 (192.168.2.1) the route goes through the WAN IP and not the tunnel. I am not sure if this is normal behavior for a cisco router but seems unlikely.
Below is an example of the traceroute:
santo-861#traceroute 192.168.2.1
Type escape sequence to abort.
Tracing the route to 192.168.2.1
1 192.168.1.254 4 msec 0 msec 4 msec
2 174.141.x.x.nw.nuvox.net (174.141.x.x) 8 msec 12 msec 8 msec
3 ge8-3.x.nw.nuvox.net (209.177.x.x) 28 msec 48 msec 8 msec
4 ge8-3.x.nw.nuvox.net (209.177.x.x) !H * *
santo-861#
Thanks for the help.
Hmm, thanks for the reply but I don't think it is correct to move the issue to the service provider. I am almost positive the issue has something to do with the configuration or function of one of or both routers I have. I just find it very unlikely the two service providers I have could cause VPN traffic not to route correctly but still allow the connection to be made.
Like I stated before, if i do a traceroute from the 861 to the LAN IP of the WRV210 (192.168.2.1) the route goes through the WAN IP and not the tunnel. I am not sure if this is normal behavior for a cisco router but seems unlikely.
Below is an example of the traceroute:
santo-861#traceroute 192.168.2.1
Type escape sequence to abort.
Tracing the route to 192.168.2.1
1 192.168.1.254 4 msec 0 msec 4 msec
2 174.141.x.x.nw.nuvox.net (174.141.x.x) 8 msec 12 msec 8 msec
3 ge8-3.x.nw.nuvox.net (209.177.x.x) 28 msec 48 msec 8 msec
4 ge8-3.x.nw.nuvox.net (209.177.x.x) !H * *
santo-861#
Thanks for the help.
Hmm, thanks for the reply but I don't think it is correct to move the issue to the service provider. I am almost positive the issue has something to do with the configuration or function of one of or both routers I have. I just find it very unlikely the two service providers I have could cause VPN traffic not to route correctly but still allow the connection to be made.
Like I stated before, if i do a traceroute from the 861 to the LAN IP of the WRV210 (192.168.2.1) the route goes through the WAN IP and not the tunnel. I am not sure if this is normal behavior for a cisco router but seems unlikely.
Below is an example of the traceroute:
santo-861#traceroute 192.168.2.1
Type escape sequence to abort.
Tracing the route to 192.168.2.1
1 192.168.1.254 4 msec 0 msec 4 msec
2 174.141.x.x.nw.nuvox.net (174.141.x.x) 8 msec 12 msec 8 msec
3 ge8-3.x.nw.nuvox.net (209.177.x.x) 28 msec 48 msec 8 msec
4 ge8-3.x.nw.nuvox.net (209.177.x.x) !H * *
santo-861#
Thanks for the help.
Hmm, thanks for the reply but I don't think it is correct to move the issue to the service provider. I am almost positive the issue has something to do with the configuration or function of one of or both routers I have. I just find it very unlikely the two service providers I have could cause VPN traffic not to route correctly but still allow the connection to be made.
Like I stated before, if i do a traceroute from the 861 to the LAN IP of the WRV210 (192.168.2.1) the route goes through the WAN IP and not the tunnel. I am not sure if this is normal behavior for a cisco router but seems unlikely.
Below is an example of the traceroute:
santo-861#traceroute 192.168.2.1
Type escape sequence to abort.
Tracing the route to 192.168.2.1
1 192.168.1.254 4 msec 0 msec 4 msec
2 174.141.x.x.nw.nuvox.net (174.141.x.x) 8 msec 12 msec 8 msec
3 ge8-3.x.nw.nuvox.net (209.177.x.x) 28 msec 48 msec 8 msec
4 ge8-3.x.nw.nuvox.net (209.177.x.x) !H * *
santo-861#
Thanks for the help.
Hmm, thanks for the reply but I don't think it is correct to move the issue to the service provider. I am almost positive the issue has something to do with the configuration or function of one of or both routers I have. I just find it very unlikely the two service providers I have could cause VPN traffic not to route correctly but still allow the connection to be made.
Like I stated before, if i do a traceroute from the 861 to the LAN IP of the WRV210 (192.168.2.1) the route goes through the WAN IP and not the tunnel. I am not sure if this is normal behavior for a cisco router but seems unlikely.
Below is an example of the traceroute:
santo-861#traceroute 192.168.2.1
Type escape sequence to abort.
Tracing the route to 192.168.2.1
1 192.168.1.254 4 msec 0 msec 4 msec
2 174.141.x.x.nw.nuvox.net (174.141.x.x) 8 msec 12 msec 8 msec
3 ge8-3.x.nw.nuvox.net (209.177.x.x) 28 msec 48 msec 8 msec
4 ge8-3.x.nw.nuvox.net (209.177.x.x) !H * *
santo-861#
Thanks for the help.
Hmm, thanks for the reply but I don't think it is correct to move the issue to the service provider. I am almost positive the issue has something to do with the configuration or function of one of or both routers I have. I just find it very unlikely the two service providers I have could cause VPN traffic not to route correctly but still allow the connection to be made.
Like I stated before, if i do a traceroute from the 861 to the LAN IP of the WRV210 (192.168.2.1) the route goes through the WAN IP and not the tunnel. I am not sure if this is normal behavior for a cisco router but seems unlikely.
Below is an example of the traceroute:
santo-861#traceroute 192.168.2.1
Type escape sequence to abort.
Tracing the route to 192.168.2.1
1 192.168.1.254 4 msec 0 msec 4 msec
2 174.141.x.x.nw.nuvox.net (174.141.x.x) 8 msec 12 msec 8 msec
3 ge8-3.x.nw.nuvox.net (209.177.x.x) 28 msec 48 msec 8 msec
4 ge8-3.x.nw.nuvox.net (209.177.x.x) !H * *
santo-861#
Thanks for the help.
Hmm, thanks for the reply but I don't think it is correct to move the issue to the service provider. I am almost positive the issue has something to do with the configuration or function of one of or both routers I have. I just find it very unlikely the two service providers I have could cause VPN traffic not to route correctly but still allow the connection to be made.
Like I stated before, if i do a traceroute from the 861 to the LAN IP of the WRV210 (192.168.2.1) the route goes through the WAN IP and not the tunnel. I am not sure if this is normal behavior for a cisco router but seems unlikely.
Below is an example of the traceroute:
santo-861#traceroute 192.168.2.1
Type escape sequence to abort.
Tracing the route to 192.168.2.1
1 192.168.1.254 4 msec 0 msec 4 msec
2 174.141.x.x.nw.nuvox.net (174.141.x.x) 8 msec 12 msec 8 msec
3 ge8-3.x.nw.nuvox.net (209.177.x.x) 28 msec 48 msec 8 msec
4 ge8-3.x.nw.nuvox.net (209.177.x.x) !H * *
santo-861#
Thanks for the help.