I have an issue where traffic is no longer passing over the tunnel.

Below is my config and I can not get access to the other side due to not being allowed. I just need to make sure my config is right so the other chaps keep looking at their side.

When I do the following:

show crypto isakmp sa 

I get:

peer peer QM_IDLE 2019 ACTIVE

crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key 12345678 address

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
mode tunnel
crypto ipsec df-bit clear

crypto map SDM_CMAP_1 1 ipsec-isakmp 
description Tunnel to
set peer
set transform-set ESP-3DES-SHA 
match address 100

interface Vlan1
description $FW_INSIDE$
ip address
no ip redirects
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1412

interface Dialer0
description $FW_OUTSIDE$
ip address negotiated
no ip redirects
ip mtu 1452
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap callin
ppp chap hostname [email protected]
ppp chap password 0 123456
crypto map SDM_CMAP_1

ip nat inside source route-map SDM_RMAP_1 interface Dialer0 overload
ip route Dialer0 permanent

access-list 1 permit
access-list 100 permit ip
route-map SDM_RMAP_1 permit 1

I just can not see what I am missing as traffic falls in the range of the access list but when I do a show ip access=list the counters don't increase.

Any ideas as I can not reach network?

  • 1
    What do you mean "no longer passing through tunnel?" What changed?
    – Ron Trunk
    Sep 5, 2017 at 23:07
  • Far end router was rebooted so I am 99% sure its not my problem but I can not get access to the other router as not allowed. I just need to know if my config is correct and if I have missed something.
    – timv
    Sep 6, 2017 at 0:27
  • Follow up question on my comment, should the show ip access-list counts increase if I try ping network as they are not incrementing.
    – timv
    Sep 6, 2017 at 0:28

1 Answer 1


Ok so I was suspecting a NAT issue as traffic for was going out into the internet.

Here is extra code that ensures traffic for the VPN is not NATTED.

access-list 101 deny   ip
access-list 101 permit ip any
route-map SDM_RMAP_1 permit 1
 match ip address 101

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.