I have been trying to setup a vpn between 2 cisco 837 routers.
Router A has an IP = 192.168.1.1 & WAN IP 160.160.160.100
Router B (client) has an IP = 192.168.2.1 & WAN IP 160.160.160.200

The routers appear to be connecting to each other ok as each router
can ping both it own WAN IP and its corresponding routers WAN IP.
However whilst Router A can ping the address WAN address of router B
(160.160.160.200) it can not ping the router B IP address 192.168.2.1
and vise versa.

Router A can ping both it's own WAN ip and Internal IP as can router B

I have added obvious routes such as ip route 192.168.2.0 255.255.255.0
160.160.160.200 on router A and router B

I think that my access-list are allowing the traffic but am not 100%
Is there a way to debug the traffic to see if the pings are being
blocked.

What do you think it would be?

Thankyou
Justin

On Mon, 19 Jul 2004 18:45:40 -0500, Justin wrote:

> I have been trying to setup a vpn between 2 cisco 837 routers. Router A
> has an IP = 192.168.1.1 & WAN IP 160.160.160.100 Router B (client) has
> an IP = 192.168.2.1 & WAN IP 160.160.160.200
>
> The routers appear to be connecting to each other ok as each router can
> ping both it own WAN IP and its corresponding routers WAN IP. However
> whilst Router A can ping the address WAN address of router B
> (160.160.160.200) it can not ping the router B IP address 192.168.2.1
> and vise versa.
>
> Router A can ping both it's own WAN ip and Internal IP as can router B
>
> I have added obvious routes such as ip route 192.168.2.0 255.255.255.0
> 160.160.160.200 on router A and router B
>
> I think that my access-list are allowing the traffic but am not 100% Is
> there a way to debug the traffic to see if the pings are being blocked.
>
> What do you think it would be?
>
> Thankyou
> Justin

My first guess is that the encryption domains/match address access-lists
do not contain entries for the WAN ip to the remote LAN subnet.

Have you tried an extended ping sourced from the LAN interface? Do the
SA's get built?

Config(s) and/or debugs would tell.

Rik Bain