IPSEC VPN between two Cisco fails with NAT in between
Posted on 2013-01-17
I'm having some problems with a VPN tunnel ... basic setup is two current Cisco routers (880 series) with up-to-date IOS. One side has a fixed IP address, the other is using a 4G uplink via an external router. This has a dynamic IP towards the Internet, static RFC IP towards the Cisco. Phase 1 is set up correctly, but no packets are transmitted via the tunnel.
We've set up the whole config in a GNS sim, using basically the some config with copy&paste from the live systems. When not using NAT on the "Internet" router, the VPN connection comes up with both P1 and P2, and transfer via the VPN link works fine. As soon as I activate NAT on the "Internet" router (and after clearing and re-establishing the IKE connection), transfer now runs exclusively on UDP 4500 (as it's supposed to), but no packets seem to be arriving on the remote end, no matter from which end I do a ping. Displaying packets ("debug ip packet") and the interface counters confirm that packets are arriving, but somehow the ipsec sa does not show any received packets, neither ones that are decoded, nor otherwise ...
I'm more or less at a loss to further debug this issue ... from all I know and see, the VPN ought to be working ...