This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Net 2 Net problems

Hi

I have a version 2.016 of ASL set-up in our northern office that has been handling RoadWarrior VPN great for about 6 months now  [;)]

We recently opened a Southern office and set up an ASL [same version] to test out Net 2 Net IPSEC for inter-office traffic.

Northern office set-up
Ext_interface: xxx.xxx.xxx.xxx
Int_interface: 192.1.91.249
Int_Network: 192.1.91.0

[This ASL uses MASQ to allow users access to the Net.]

Southern office set-up
Ext_interface: yyy.yyy.yyy.yyy
Int_interface: 192.168.91.250
Int_Network: 192.168.91.0

Set-up Rules etc.. and the connection establishes fine.

Southern office live log:
192.168.91.0/24    -> 192.1.91.0/24      => tun0x1004@xxx.xxx.xxx.xxx

northern office live log:
192.1.91.0/24      -> 192.168.91.0/24    => tun0x1002@yyy.yyy.yyy.yyy

But I cant ping any IP in either network from the other, ping 192.1.91.1 from 192.168.91.x etc...

Any help more than welcome   [:)]

This thread was automatically locked due to age.

0 BoFH over 23 years ago

I am having exactly the same problems... I have however got mine working.

But when performing trace routes etc I get the following:

astaro-gw.network-a
* * * * Request Timed Out
pc.network-b

It must be something todo with the gateways set by astaro... I also cannot traceroute or do anything from network-b to network-a. All of the correct packet filters such as:

On astaro-gw-network-a

network-a     any     any
network-b     any     network-a

On astaro-gw-network-b

network-b     any     any
network-a     any     network-b

Its very weird..  anyone got any ideas? I have emailed astaro but nothing so far...
- 0 oliver.desch over 23 years ago in reply to BoFH
  Hello alltogether,
  
  
  astaro-gw.network-a
  * * * * Request Timed Out
  pc.network-b
  If I got it right that means that you can access
  computers in network-b from a!
  
  What about the ICMP settings? Enable for testing
  purposes ICMP on and ICMP through firewall!
  
  You need at least two packet filter rules on both
  sides for full access.
  
  code:
  network-b ANY network-a ALLOW
  network-a ANY network-b ALLOW
  Its very weird.. anyone got any ideas? I have emailed astaro but nothing so far.
  Cannot find a support e-mail from you!
  
  read you
  o|iver
  - 0 Palantir over 23 years ago in reply to oliver.desch
    
    Chris, in my experience, this is often a problem having to do with routing.
    
    First of all, make sure there is no gateway defined on the internal interfaces of both Astaro's (pretty sure you have this since the tunnel is up).
    
    Does a ping from the Tools menu on the Northern Astaro to the Southern INTERNAL interface (and vice versa) work? If not, make sure that - as Oliver wrote - you define the proper rules in BOTH WAYS on BOTH ROUTERS.
    
    If this ping DOES work, and you cannot ping any clients, it most probably has to do with your routing.
    
    Make sure that you have defined the route to the Southern network on your Northern routers, or define the Astaro's as your default gateway for your internal clients (and the other way around).
    
    Good luck!
  - 0 BoFH over 23 years ago in reply to Palantir
    
    Hi Oliver, Ill send another email now...
    
    Certainly the tunnels are working...
    
    Do you have icq or anything oliver? Easier than a email conversation...
    
    Lee
  - 0 BoFH over 23 years ago in reply to BoFH
    
    I have the rules enabled, but still my astaros cannot ping each other...
  - 0 Chris Mayers over 23 years ago in reply to BoFH
    
    Thanks for all the response  [:)]
    
    just to recap:
    North net = 192.1.91.0
    South net = 192.1.92.0
    The routers can ping each other, better than that, sat on North network I can run the webadmin on the south network ASL but cannot get any further either with ping OR http.
    
    I have Exchange servers sat on both networks and need to establish, amongst other things, site connectors between the two.
    
    I tried pinging sout network from north ASL: ping 192.1.92.1 but get nothing  [:(]
    
    Any more ideas welcome  [;)]
  - 0 Chris Mayers over 23 years ago in reply to Chris Mayers
    
    Ahh.. just noticed, as you will see from the last mail south net is now 192.1.92.0 not 192.168.91.0 as before.
    
    I also have rules north south at both ends but I am using MASQ NAT at both ends, will this stop the VPN from working?
    
    Just to add a bit more to the setup, I have working PPTP VPN access at both ends as well.
  - 0 BoFH over 23 years ago in reply to Chris Mayers
    
    MASQ Shouldnt make any difference really... I am at the same point as you... where a can see b but not the other way around. I was having problems with RSA etc but Ive solved those now...
    
    It seems to be some kind of gateway/routing problem but I cant see why... I can ping/trace perfectly to the ASL machine on network-b.
    
    Saying that, looking at my routing table, its giving the outside address of asl2 as the gateway address... surely this needs to be the internal if' of the box??? That would make sense, thats how our Windows-Windows setup worked before...
    
    For performance I might have to go back to Windows [:(]
    
    Ive emailed Astaro again, so hopefully a response will come soon...
  - 0 BoFH over 23 years ago in reply to BoFH
    
    Also your 192.1.92.0/24 is a real IP range allocated to a real network... didnt you want to use private addresses?
  - 0 Palantir over 23 years ago in reply to BoFH
    
    Chris, what kind of routing device(s) do you have on your Southern network? I am quite certain that's where your problem is coming from, since the two ASL can ping each other.
    
    Could you set-up a device on the southern network with its default gateway set to the Southern ASL? You should be able to ping it then from your northern network. If this works, check any routers on the southern network for a proper routing statement to the nothern network.
    
    G'luck