Setting up VPN FW router (Draytek 5510) with multiple Watchguard Firebox X Series 500 FW's - locally and through MPLS

I had posted the same comment in your other question, pasting again:

I am assuming that when you are connecting through MPLS then things work fine [per your original post]; the problem is only seen when you have users coming through VPN, I have few questions on this:
1. Are the users coming as part of BOVPN between the two FBX500 boxes; OR
2. The users are remote users who VPN into FBX500 at some specific site [say HK]; and you already have BOVPN implemented between HK and Hosting centre [HC]; OR
3. The users are remote users who VPN into FBX500 at some specific site [say HK]; and you do have VPN between the HK and HC using MPLS; OR
4. The users are remote users who VPN into FBX500 at some specific site [say HK]; and you do not have any VPN between HK and HC.

In case 1, there should be firewall policies on both X500 to allow traffic from/to remote subnets.
In 2, you must incorporate zero route [Force all traffic through tunnel] for remote users; further if the remote users are connecting on some IP subnet which is not same as the internal IP subnet, we need to include both the subnets in the VPN configuration.
In 3, FBX would have route in place to forward traffic to other subnet through MPLS router; in MPLS router we need to have all the routing information.
Further the remote users should be configured as zero route tunnel.
In 4, I do not think this is applicable case! :)

Please provide details.

Thank you.

Hi,

Sorry for the "anyone out there" comment lol.  

I think I have explained too many sites, and gone through confusing and uneeded detail, so lets keep it simple:

site 1 (main site/VPN entry point):
draytek 5510 VPN FW router - internal IP 192.168.21.252, external IP 193.85.110.99 - users connect to this through VPN
Cisco MPLS router - internal ip 192.168.21.253 - cant ping from site 3 (user at home connecting through VPN)
Watchguard Firebox X series 500 - internal IP 192.168.21.1 (default GW for servers and WS's in site 1)

Site 2 (hosting centre where VOIP server are run from):
Cisco MPLS router - internal IP 192.168.22.253
Watchguard Firebox X series 500 - internal IP 192.168.22.1 (default GW for servers and WS's in site 2)

Site 3 (user connecting into site 1 through VPN):
Draytek 2820 VPN router - internal IP 193.168.50.1, external IP is dynamic, working through Dynamic DNS
Worstation - internal IP 192.168.50.3

site 3 needs to VPN into Draytek 5510 FW in site 1 (external IP 193.85.110.99), this VPN is tested and working.  The workstation in site 3 (192.168.50.3) can ping everything in site 1 apart from the Cisco router (192.168.21.253).  Site 3 worstation cannot ping anything in site 2 (192.168.22.n).  All equipment in site 1 can ping all equipment in site 2.  Site 1 and 2 are connected via MPLS through the Cisco MPLS routers.  Both site 1 and 2 have 2 Cisco routers, one for MPLS routing and one for internet.  

Please let me know if you need any more detail.  

I basically need the VPN router to see the 192.168.22.n as at the moment it can only see the 192.168.21.n apart from the Cisco router (192.168.21.253)

Thanks

Neo3998

p.s the reason i am trying to set this up is so that i can run VOIP soft phones from users homes running through the VPN and routing between sites via the MPLS.  

TIA

As you have MPLS between 192.168.21.x and 192.168.22.x sites, you must have added routes on draytek and X500 as:
site 1: 192.168.22.0/24 GW 192.168.21.253 [Cisco router]
site 2: 192.168.21.0/24 GW 192.168.22.253 [Cisco router]

On cisco router at site1, you should also have ACL which would allow traffic from 192.168.50.0/24; also a route to send traffic back to 192.168.50.0/24 subnet through 192.168.21.252 [draytek]; also at site2 it should accept packets from back .21 and .50 subnets and route back as well.

As users are connecting to draytek, you should configure either zero route tunnel OR provide access to two subnets for remote users [192.168.21.0/24; 22.0/24] on draytek [not sure on the options, but can look at manuals and help if need (please provide the current version of software)], so from client which is at 192.168.50.x, would send traffic for both subnets to draytek.
Draytek would send all traffic from .50.0/24 and .21.0/24 to cisco router; which would send it to the site2. Site2 router would allow traffic from both .21 and .51 subnets and would routes back to site1. at site1, draytek would then route the packets to remote users thus completing the loop.

Hope I have not confused you.

Please check and update.

Thank you.

Brilliant explanation and not at all confusing, thankyou.  I cannot make the changes until saturday evening now as I have to wait for a window to perform this work.  I will let you know how i get on.

Thanks again

Neo3998

Please update how things go.

Thank you.

I have tried the suggestions that you made and have not had any luck.  I have also attached a very simplified diagram of the scenario at hand.  Could you please let me know if you have any ideas??

Can you ping the cisco router from the remote draytek router; and vice versa; if nothing; then we need to resolve this issue first.

If above works then only the remote users would be able to ping anything.

Please check and update.

Thank you.

remote user can ping everything on the 172.21.21x range and nothing past that.  

oops remote user can ping and tracert anyhting on 192.168.21.x range from 192.168.50.x range, the cisco is 192.168.21.253 and I can ping this fine.  When inside the 192.168.21.x network i can ping and tracert to all devices on the 192.168.22.x network, but cannot ping or tracert anything on this network from 192.168.50.x range.  

Can you run some packet capture and see if the packets from remote users are coming for .21 and .22 subnets to the .50 network itself; if yes, then are they getting routed over tunnel and getting to the other end. If yes, then are they getting routed over MPLS and finally on the reverse path.

Please have the remote user connected and control the session using RDP or some other remote connection tool; put a source filter on packet capture and then see for incoming packets.

Here we are not sure on the point of failure; so need these many details.

Thank you.

Hi,

I am a little confused by your response.  I am not entirely sure what you want me to do, sorry.  I understand you want me to RDP/Dameware to a machine from 172.21.50.n to another machine on the 172.21.21.n, but I cannot RDP/Dameware to any machines on the 172.21.22.n from the 172.21.50.n.

how do i set a source filter on packet capture?

Thanks

Neo3998

The reason I wanted you to run packet capture was to check if the packets are reaching from draytek to cisco at all; and then onto the MPLS and back; if this basic thing is not working then the VPN itself would not work.
We first need to get ping or any other direct traffic from router on .60. network to cisco and over MPLS and back.

You can leave the RDP part at this time; sorry to confuse you.

Please update.

right when i run tracert from 192.168.50.n to anywhere on 192.168.21.n it can get through fine and vice versa, from 192.168.21.n back to the 192.168.50.n.  

tracert from 192.168.22.n to 192.168.21.n fine, but when i try to tracert to 192.168.50.n it cannot get through.  It can ony get to the WAN interface of the router and no further.  The next hope would be 192.168.21.252 (Draytek VPN FW router), but for some reason the router will not let traffic through or in, this includes ICMP.  

Do you know anything about Drayteks??? The router cannot route through this router and I fear it may be a config error.  Could someone please help me with the draytek routing.  Can the 192.168.50.n only see the 192.168.21.n because it has an IP address on the same internal range?

I am baffled on the next step.  here is the routing table from the 192.168.21.252 Draytek router:

Key: C - connected, S - static, R - RIP, * - default, ~ - private
*             0.0.0.0/         0.0.0.0 via 193.82.112.97,   WAN1
C~        192.168.21.0/   255.255.255.0 is directly connected,    LAN
S~        192.168.22.0/   255.255.255.0 via 172.21.21.253,    LAN
S~        192.168.23.0/   255.255.255.0 via 172.21.21.253,    LAN
S~        192.168.24.0/   255.255.255.0 via 172.21.21.253,    LAN
S~        192.168.25.0/   255.255.255.0 via 172.21.21.253,    LAN
S~        192.168.50.0/   255.255.255.0 via 79.78.168.189,    VPN
C       193.85.110.96/ 255.255.255.240 is directly connected,   WAN1

now the VPN route set here via IP is linked to a DynDNS address rather than IP, would this cause a problem routing to the rest of the subnets??  Also the WAN1 IP address is confusing me as I have set it to 193.85.110.99 on the router and it is displaying .96.  

Please let me know if you need any more detail.

Thanks

Neo3998

Hi,

Sorry that is my error yes it is set as 192.168.21.253, I have also asked the question to one of my freinds who knows my network, but he is baffled as to why the draytek cannot talk to the Watchguard FW.  

if I look at the IPsec tunnel in connection manager on the router it shows that DynDNS is refreshing the GW IP when the ISP IP address changes.  

I dont know where to go next with this one!!! can the draytek and the WG FW actually talk to one another, and why cant anything route through the 192.168.21.252 Draytek router?  Would this be anything to do with the 192.168.50.n being attached via VPN.  If VPN is setup they should be able to use all network resources accordingly, am I right here? This is the first VPN that I have setup and if the telephone equipment was actually on this subnet there wouldnt have been an issue.  

Arrrghhh why cant this range see the other subnets?

I'm stumped :(

Thanks

Neo3998

Can you also give sanitized routes from 192.168.21.253 router; please remote all MAC addresses, WAN IP information.
I think as from 192.168.50.x you can access 192.168.21.x subnet, there is something on cisco router which does not router traffic over MPLS and hence you cannot see 192.168.22.x subnet.

Also, I was thinking on another line, is it really necessary for 192.168.50.x subnet to get routed to 192.168.22.x through 192.168.21.x; can't we just create a VPN from draytek at 192.168.50.x to WG at 192.168.22.x. This would simplify things.

Please advice.

Thank you.