We have six remote offices that we want to VPN back to our central office. The central office location has a T1 with an Adtran Netvanta 3200 Router and Cisco Pix 506E v6.3(3). We also use ISA 2004 located on a Small Business Server 2003 R2. The remote offices all have DSL(6mB/512mB), smallest office will have 6 people largest will have around 10-12. We want to use the Linksys BEFVP41 at each location to establish a VPN tunnel to the central office Pix. We also want to add a Windows 2003 R2 server to each location which will be added as a member server to the central office domain.
I have setup the PIX and the Linksys for this to work. Right now on the BEFVP41 side under VPN it shows "CONNECTED". In the log on the BEFVP41 it sows "Set up ESP tunnel with xx.xxx.xx.xxx Sucess!" But, I cannot ping any IP's on the central office LAN or vise versa. Has anyone done this successfully? What am I doing wrong.....
Thanks for the help.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Cannot ping either direction. How do I setup the traffic to travel across the tunnel? How do I exclude the same traffic from NAT? On the routing tables, how do I know there set correctly?
The inside Ip of the Linksys side LAN is 192.168.0.58. Could this be something in ISA 2004? Should I have an access rule to allow all VPN traffic/protocols?
I have attached running config from Pix and screen shots from Linksys.
Thanks.....
To set up the traffic to travel across the tunnel, you need to configure an ACL on the PIX which will identify the source and destination networks. You've done this in your "outside_cryptomap_10" ACL.
To specify that traffic will not use NAT on the PIX, you set up another ACL with the source and destination networks, and then you use the "nat 0" command. You've done this with the "inside_outbound_nat0_acl"
On the Linksys, it doesn't really give you any of those options. You simply tell it what your local LAN is ("Local Secure Group") and what your remote LAN is ("Remote Secure Group") and then set up the tunnel stuff. The problem with the Linksys is that you can only specify one remote LAN. Since you've defined 10.0.0.0/24, that's the only network you can communicate with. The PIX ACLs also identify 192.168.1.0/24 as a network that should communicate with the Linksys LAN, but that won't happen because the Linksys will not be able to send traffic back across the tunnel for 192.168.1.0/24 because it doesn't have the capability of identifying multiple networks for the remote side.
From what I can see, your basic config looks okay. I would think you could ping the Linksys inside interface (192.168.0.58, I think) from the PIX. To do this, though, you must specify the interface on the PIX from which the traffic should initiate. The command would be "ping inside 192.168.0.58".
Where does the ISA server phyiscally sit in all of this?
<-=+=->
So, the ISA server should not be a factor in this. I'm assuming that the network on the other side of the ISA server is the 192.168.1.0/24 segment and it's "outside" interface is 10.0.0.0/24?
What happens if you try to ping a 10.0.0.0/24 address (not the PIX inside interface) from a 192.168.0.0/24 address (not the Linksys) and vice versa? Same thing?
<-=+=->
I'd try removing the following command from your PIX:
access-list outside_cryptomap_10 permit ip 192.168.1.0 255.255.255.0 192.168.0.0 255.255.255.0
I mean, the Linksys isn't going to send traffic that way anyway because it can only list one network (10.0.0.0/24) as a destination. So, there's really no reason to define that in the PIX's ACL. You can use the same list, by the way, for the nat (inside) 0 line as well instead of creating a second one (inside_outbound_nat0_acl)
It's a shot in the dark, but I'm hoping that since the lists don't match, it's causing a problem (althought I doubt it).
I'm looking at the configs again to see what I can see. They look pretty good.
Silly question, but the machines that you're using to test... the default gateway is pointed to the PIX inside interface or the Linksys inside interface, right?
<-=+=->
Removed
access-list outside_cryptomap_10 permit ip 192.168.1.0 255.255.255.0 192.168.0.0 255.255.255.0
Had no affect. Did a ping from the PIX, timed out. The remote location(Linksys side) is just down the block from me and since removing the ACL I haven't been able to go there and check to make sure I'm still connected to the VPN. I'll let you know once I'm down there.
Well, it's not going to work from inside the ISA server's network at all. The reason why is because the Linksys is only sending 10.0.0.0/24 traffic (presumably) across the tunnel. 192.168.1.0/24 traffic is not going across the tunnel because that's not defined as the "Remote Secure Group". So, the Linksys does not know that it's supposed to send traffic for that network across the tunnel.
Does that make sense?
<-=+=->
Business Accounts
Answer for Membership
by: SplinterCell5894Posted on 2008-04-17 at 07:15:07ID: 21377273
I've set up a tunnel between the BEFVP41 and a PIX 515. My experience has been that if the Linksys shows connected, then you probably are.
So, at this point, I'd take a look at the following:
1. Are your routing tables set up correctly?
2. Can you ping the inside interface of the Linksys from the Cisco ("ping inside w.x.y.z")?
3. Have you defined the traffic to travel across the tunnel correctly?
4. Have you excluded that same traffic from NAT?
That's where I'd start.
Also, feel free to post the (sanitized) "show run" from your PIX and you can attach screen shots of the Linksys.
<-=+=->