This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Ipsec question (have I found a bug in strongwan?)

Hello

I will explain my network first -

Site A= 192.168.89.0 (XG site)

Site B= 192.168.82.0 (TMG)

Site B is TMG (I know - its old - I set up at my parents years ago). 

Site A - newly setup XG. 

IPSEC site to site. All set, good to go. Both pingable.

 

Site a (XG)<-----------------> Site b(TMG)

192.168.89.0                        192.168.82.0

 

Now, If I start a redirection from site B to Site A (This redirection is from game server), The game server at Site A (XG side) is dropped by XG to route via the tunnel. This XG site server(192.168.89.97) can never ping ANY site at TMG side now. On packet capture, I see that XG is now trying to route the packet (source is XG Site LAN) via WAN IP, instead of the LAN IP. 

In the below packet capture, I have set two pings. One is from 192.168.89.10 to 192.168.82.97( This is routed properly)

Other is 192.168.89.97 to 192.168.89.97. This works well, but the moment i start the redirection server, it stops pinging. Uninstalling the redicrection doesnot help. Rebooting doesnot help. ONLY change in IP helps.

Both the 192.168.89.x have gateway set as 192.168.89.1

 Magically, If i change the IP from 192.168.89.97 to any other ip, it starts working!!

192.168.89.97 is lost to me now as I can never use it again.

I have restarted both TMG and XG to see if there is any reminiscent of route left. It doesnot route 192.168.89.97 EVER.

 

(Sorry if the above is complex - Its too complex for me to understand too - I have wasted 5 days trying to troubleshoot. Why XG is putting WAN ip to route a pacjet on IPSEC tunnel?)



This thread was automatically locked due to age.
Parents
  • Cannot edit the post - 

    In above post, two pings are on.

    192.168.89.10 is pinging 192.168.82.97  <-- This works.

    192.168.89.97 is pinging 192.168.82.97  <-- This does not work.

    There is no problem the other way (ie, TMG all IPs can ping XG site, even 192.168.82.97)

     

    Photo1 - 192.168.89.97 trying to ping 192.168.82.97

     

    Photo 2

    192.168.89.10 pinging 192.168.82.97 successfully. Both 192.168.89.10 and 89.97 are behind XG

     

Reply
  • Cannot edit the post - 

    In above post, two pings are on.

    192.168.89.10 is pinging 192.168.82.97  <-- This works.

    192.168.89.97 is pinging 192.168.82.97  <-- This does not work.

    There is no problem the other way (ie, TMG all IPs can ping XG site, even 192.168.82.97)

     

    Photo1 - 192.168.89.97 trying to ping 192.168.82.97

     

    Photo 2

    192.168.89.10 pinging 192.168.82.97 successfully. Both 192.168.89.10 and 89.97 are behind XG

     

Children
No Data