1841 site to site VPN routing question

[lhatwwp]

Hello,

I used the built in wizard to create a site to site VPN tunnel however when I attempt to test the tunnel the test fails with the following message.

FAILURE REASON
"Tunnel traffic destination must be routed through the crypto map interface. the following destinations <private nat addresses> are routed through non-crypto map interface."

RECOMMENDED ACTION
"Go to 'Configure->Routing' and Correct the routing table."

I think I understand the problem but I'm not sure how to implement a solution. It seems too me that I need to add a statement like NAT (INSIDE) 0 access-list <VPN traffic> but I'm not able to enter that command. Either I'm entering it wrong or I am using the wrong syntax.

Can someone offer some help please?

Thanks,
Lou

 

[tjbradford]

does your fw have asdm on it , if so you need to look in the following , site to site vpn | advanced | crypto Maps

if not you need to look at adding something like the following.

access-list inside_nat0_outbound extended permit ip "source" 255.255.255.0 "dest" 255.255.255.0

access-list outside_cryptomap_20 extended permit ip "source" 255.255.255.0 any


basically you need to to tell the fw what it should throw out the outside interface in clear and what should be encrypted.

ie site to site vpn also allowing web browsing

anyone else agree?