I am facing a very big problem with site to site vpn on Cisco 2900 ios.
I configured the vpn and when i ping from router itself to destination ip with source as lan interface , VPN works, no problem.
but when i connect any computer directly to router's lan interface to initiate traffic , it doesnot work at all. and on computer's lan i see yeloow sign.
mtu is 1500, speed is auto (i tried chaging also) , duplex is auto ( i tried changing also) , thoguh firewall on pc should not affect but still i disabled it.
since their is no problem with vpn config as vpn comes up when i initiate ping from router itself but i dont know why it is not working from lan.
Do we need any inspect icmp on this router also ? or any policy modification to pass traffic across the interfac on router is required ?
I was useinf Cisco 2911 c2900k9-15.0(M4).bin and i upgraded it to 15.3 which is lated to get reed of any bug .
Lastly , i connected two laptops directly to router's gi0/0, g0/1 interface to ping from one laptop to another but this also did not work.
You will need to configure that lan network as interesting traffic for the VPN, you can use the access list for this. what is the scenario for those two laptops? are they on the same subnet? different subnet? have you configured the default gateway? have you configured any static routes?
Then you have the result as below:
Lan network is configured as interesting , and whatever ip i put on router's lan interface from that subnet and initiate the traffic to other site VPN works. but when i put the same on any computer in the lan , it does not now, present :-
laptop A(192.168.1.10)---------g0/1(192.168.1.1)router(g0/1-10.0.0.1)-------10.0.0.10lapto B
laptop A is not able to ping laptop B , when i do "debug ip icmp" and initiate traffic from laptop A , i do not see anything however when i initiate ping from router "ping 10.0.0.10 source g0/1" it works and i see debugs.
And You have to use crossover cable if you connect PC directly to the router. If each laptop can ping corresponding router interface, and the gateways of that laptops set to be those interfaces' IPs, everything should work fine.