I have two sites with IPsec tunnel… only one Phase II LAN works

[ao]

1. I have two sites with IPsec tunnel... one LAN works both ways, but additional LANs do not - thet are configured as per attachment.

[ao]

While three LANs configured for Phase II - only one LAN works ... (see attachement)

[ao]

3. The Phase 1 seems to work fine ... (see attached)

[ao]

Phase II seems to setup routes  OK ...
Phase II seems to setup security Policy DB  OK ...
The IP Secs firewalls are open ...
Nothing obvious in log files ...

Looking for advice on where to look next please  :)

[Patrick M. Hausen]

The other side has all three networks as local? Have you tried enabling tunnel isolation?

[ao]

Thank You - I finally got help - it is not obvious but need to have matching rule on each end for reverse route ...

[Patrick M. Hausen]

This is obvious ;) In a static tunnel setup all participating sites need full information. Unless default routes/SAs are in place, of course.

Glad you got it working.