This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Routing from IPSEC VPN sites and multiple lans

Hi,
i have added two remote sites using an astaro and a IPSEC VPN connection with the main Astaro Firewall. the problem is that from the main LAN i can see the two remote site and vice versa but i cannot reach any other remote LAN i have connected with cisco routers.
The situation is this one :

main site    10.10.200.0/24
        gw    10.10.200.249 (astaro machine)

remote lan connected via routers 192.168.2.0, 192.168.3.0, 192.168.4.0 all having gw their cisco router .1

remote site via ipsec vpn 192.168.8.0 gw 192.168.8.1 (astaro)
                                   192.168.9.0 gw 192.168.9.1 (astaro)
PPTP pool 192.168.101.0

From the PPTP Pool i can reach all the networks and viceversa

I cannot reach remote lan from the ipsec vpn
example
i can reach 192.168.3.2 from 192.168.2.2
i cannot reach 192.168.8.2 from 192.168.2.2

i have set all the packet filter rules to allow traffic from those networks but it doesn't work.
I don't understand why the pptp can be viewed by every lan, but the two remote ipsec vpn can't from everywere? (just from the main lan and pptp pool)
thanks

This thread was automatically locked due to age.

0 mhock over 17 years ago

The reason might be that you have to tell the ciscos that the remote sites are "behind" the main site, because the remote subnets are part of the IPSEC VPN definition - same on the astaros, remote subnets in Ipsec Gateway "MainSite" must include the LANs behind the Ciscos.
You can also leave the ciscos untouched and define SNAT on AstaroMainSite from AstaroRemoteSite to CiscoLANx, so traffic from AstaroRemoteSite will appear as traffic from MainSite in the Cisco Subnet

And finally you could define a fully meshed VPN (RemoteAstaro Cisco directly)...
Hope this wasnt to confusing, I just wanted to avoid copyNpasting all those subnets....
Cancel
Vote Up 0 Vote Down

Cancel