I have 2 sites, each with a Watchguard Firebox x750e running Fireware XTM 11.0.1 and Watchguard System Manager 11.0.1. Both sites have static public IPs, I have a main office, and a branch office. Its pretty easy to configure the VPN, but its behavior is odd (this is the first VPN Ive created using these firewalls, but I have created VPNs with other appliances).
Heres some info about my network setup.
Site A (main office)
172.16.0.0/16
Firewall IP 172.16.0.1/16
Site B (remote office)
172.16.40.0/24
Firewall IP 172.16.40.1/24
The communication over the VPN is as follows.
Site A can send some information to Site B (i.e. AD replication, exchange data) but only from one IP address, 172.16.0.5 (DC) All IPs in Site B can communicate with the one IP (172.16.0.5), but not with the rest of the IPs on Site A.
So from my DC in Site A, I can replicate AD and DNS to the DC in Site B, and people in Site B can grab mail from the exchange server, but I cannot ping a single address in Site B. From the Site B side, I can ping only the DC in Site A from any address there. When I try to configure the 1:1 NAT in the VPN settings, it breaks the above said communication between the sites.
So, what I am trying to accomplish here is that I would like all network traffic to be able to flow through the VPN tunnel as if the two sites were on the same local subnet, to be able to successfully perform ping/net view/etc.. across the VPN.
Any help would be appreciated.
thanks
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
I don't have the 1:1 NAT enabled. I have the tunnel set up as you described, and it auto creates the policies, but I still have the problem. Just get a request timed out when attempting to ping the server at Site B from my PC. But if I remote into the server there, I can ping 172.16.0.5 from 172.16.40.x.
There are 3 rules configured on the Site B side (Site B was configured before I worked here) that I am unsure of. I'll list them here.
1. Policy name - DNS (Order #8)
Policy Type - DNS-Proxy
From - (Any-Trusted Any-Optional Any-External)
To - (Any-External Any-Trusted)
Ports - TCP/UDP:53
2. Policy name - Outgoing (Order #10)
Policy Type - TCP Proxy
From - (Any-Trusted Any-Optional)
To - (Any-External)
Ports - TCP:-0(Any)
3. Policy Name - TCP-Proxy (Order #11)
Policy Type - TCP-Proxy
From - (Any-Trusted Any-Optional)
To - (Any-External)
Ports - TCP:0(Any)
All 3 rules listed there are using proxies, which may be the problem. The firewall on the Site A side is new, with a basic config and only a few ports forwarded for RDP, SMTP, POP3, etc.
Auto order mode is enabled on both firewalls.
When I open the traffic monitor and try to filter my IP, then run ping -t 172.16.40.x nothing shows. I looked on the Site B side as well, and nothing shows up in the traffic monitor logs.
When I try to open Windows Firewall on the DC on Site A, I get a message saying "Windows Firewall cannot run because another program or service is running that might use the network address translation component (ipnat.sys)"
Routing for the entire Site A network.
But it looks like the previous IT employee configured RRAS on the DC.
The DC is Server 2003 SBS.
Should RRAS be removed from the DC?
The DC is the only computer that I can ping the remote site with, and vice versa.
I took a couple of screenshots of the configuration of the RRAS on the DC. If you need any more info, let me know.
General RRAS cfg
Static routes
That's an interesting way of doing things. Completely unnecessary since the 750's are more than capable of routing the 2 networks (not that I'm blaming you; I know you inherited it :) ). Was there previously a site-to-site connection (MPLS, etc), or has the company always used branch office vpn to connect the offices? The tunnel is most likely still up even after RRAS was shutdown. With RRAS shutdown there was no route for the traffic to know where to go. Is your workstation's gateway address the RRAS server by chance? If it is, give yourself a temporary static IP so you can specify 172.16.0.1 for the gateway. Then try to ping the other network.
Yeah, after I started here, I found a lot of interesting things associated with the configuration of the servers and network. The gateway for all devices on the network are 172.16.0.1, even mine. I have no idea why he configured the DC for RRAS, could have been some work around. But yes, when I disable RRAS it kills the route "172.16.40.0 255.255.255.0 172.16.0.1" and I cannot talk to the other network.
Now, I have no idea what I need to do to make this work.
the 750 on my side (Main office 172.16.0.0/16) is new. I put it in in place of an x700 which is coming to end of life. So, there's been a VPN between the 2 offices since before I worked here. It was previously configured between the x700 and the x750.
If I get rid of RRAS on the DC, will I need to add a static route to the routing table?
I've assigned myself a static IP of 172.16.0.102/16 g=172.16.0.1 and I get timed out responses when pinging the other network currently.
Post the settings for the 750 from Site A? Since RRAS is enabled and configured, I cannot ping the network 172.16.40.x from any computer on the 172.16.x.x side except from the DC which is the server that has RRAS enabled. If I add that static route (172.16.40.0 172.16.0.1) to any other computer, I still cannot communicate. Here's a screenshot of the 750 configuration from the Site A side. I blanked my external IP's.
x750 config Site A
So, for now, this is what I've done as a temporary fix.
Disabled Routing and Remote Access on the DC.
performed the following on all of my servers:
"Route add 172.16.40.0 mask 255.255.255.0 172.16.0.1"
Now, I can communicate between Site B and all the servers/computers that I add the static route to.
If anyone knows a better solution for this to work without me having to manually add routes to the routing table, it would be greatly appreciated.
can you post screenshots or the results of the followig:
A.- from on of your servers with the route added
ipconfig /all
tracert 172.16.40.x
tracert www.google.com
B.- from one of your pc without the routed added manually
ipconfig /all
tracert 172.16.40.x
tracert www.google.com
ok.. here's the requested info from my laptop and a server. The laptop does not have the static route added to the routing table. The server has the static route added and can talk to the other side of the VPN.
First, here's the info from my laptop:
C:\>ipconfig /all
Windows IP Configuration
Host Name . . . . . . . . . . . . : it-kenny
Primary Dns Suffix . . . . . . . : CBS.local
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : CBS.local
cbs.local
Ethernet adapter Local Area Connection 4:
Media State . . . . . . . . . . . : Media disconnected
Description . . . . . . . . . . . : NCP Secure Client Virtual Adapter
Physical Address. . . . . . . . . : 02-00-4E-43-50-49
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . : cbs.local
Description . . . . . . . . . . . : Intel(R) 82567LM Gigabit Network Con
nection
Physical Address. . . . . . . . . : 00-21-70-B9-55-3E
Dhcp Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 172.16.0.102
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : 172.16.0.1
DNS Servers . . . . . . . . . . . : 172.16.0.5
172.16.40.16
Primary WINS Server . . . . . . . : 172.16.0.5
C:\>tracert 172.16.40.16 -h 10
Tracing route to fireball.cbs.local [172.16.40.16]
over a maximum of 10 hops:
1 * * * Request timed out.
2 * * * Request timed out.
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.
Trace complete.
C:\>tracert www.google.com
Tracing route to www.l.google.com [64.233.169.147]
over a maximum of 30 hops:
1 1 ms 36 ms 1 ms 172.16.0.1
2 20 ms 22 ms 12 ms 10.30.16.1
3 * * * Request timed out.
4 24 ms 43 ms 26 ms s208-180-36-173.snjs.ca.st
180.36.173]
5 29 ms 22 ms 23 ms xe-1-2-0.mpr3.sjc7.us.abov
6 49 ms 35 ms 31 ms xe-1-0-0.mpr4.sjc7.us.abov
7 35 ms 20 ms 49 ms 74.125.49.21
8 24 ms 33 ms 40 ms 72.14.239.252
9 103 ms 74 ms 90 ms 209.85.242.210
10 73 ms 82 ms 77 ms 209.85.249.18
11 98 ms 112 ms 123 ms 209.85.242.209
12 107 ms 112 ms 96 ms 64.233.175.219
13 103 ms 109 ms 106 ms 72.14.232.21
14 106 ms 119 ms 103 ms yo-in-f147.google.com [64.233.169.147]
Trace complete.
C:\>
--------------------------
Now, here's the same tests run on m file server.
C:\>ipconfig /all
Windows IP Configuration
Host Name . . . . . . . . . . . . : cbsfs1
Primary Dns Suffix . . . . . . . : CBS.local
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : CBS.local
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . : cbs.local
Description . . . . . . . . . . . : Intel(R) PRO/100 Network Connection
Physical Address. . . . . . . . . : 00-B0-D0-79-89-54
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 172.16.0.14
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : 172.16.0.1
DNS Servers . . . . . . . . . . . : 172.16.0.5
172.16.40.16
Primary WINS Server . . . . . . . : 172.16.0.5
Secondary WINS Server . . . . . . : 172.16.40.16
C:\>tracert 172.16.40.16
Tracing route to fireball.cbs.local [172.16.40.16]
over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms 172.16.0.1
2 * * * Request timed out.
3 38 ms 42 ms 51 ms fireball.cbs.local [172.16.40.16]
Trace complete.
C:\>tracert www.google.com
Tracing route to www.l.google.com [64.233.169.147]
over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms 172.16.0.1
2 10 ms 19 ms 13 ms 10.30.16.1
3 * * * Request timed out.
4 19 ms 15 ms 32 ms s208-180-36-173.snjs.ca.st
180.36.173]
5 18 ms 40 ms 23 ms xe-1-2-0.mpr3.sjc7.us.abov
6 25 ms 21 ms 21 ms xe-1-0-0.mpr4.sjc7.us.abov
7 30 ms 37 ms 19 ms 74.125.49.21
8 19 ms 22 ms 24 ms 72.14.239.252
9 115 ms 76 ms 78 ms 209.85.242.210
10 74 ms 75 ms 93 ms 209.85.249.18
11 105 ms 93 ms 101 ms 209.85.242.209
12 104 ms 98 ms 96 ms 64.233.175.219
13 113 ms 105 ms 105 ms 72.14.232.25
14 104 ms 97 ms 110 ms yo-in-f147.google.com [64.233.169.147]
Trace complete.
C:\>
Well, probably be a little harder. The firebox won't allow 172.16.0.0/24 as a valid network range. I guess I could leave the firewall as 172.16.0.1/16 and just re-program the servers. But, I have like 172.16.0.x/16 as the scope that the servers are in, 172.16.1.x/16 as the scope that DHCP clients are in, then 172.16.20.x/16 as the scope that all of my printers/copiers are in. So I guess I am going to have to scrap all those, consolidate everything into a 172.16.1.x/24 scope, re-configure DHCP, etc.
So, If I change the secondary site to a whole new IP sub, re-configure just the single server over there, along with the firewall, modify the VPN settings to reflect the setting changes, then I should be able to leave the /16 on the Site A side, and have 172.17.1.0/24 for the Site B side, the firewalls should route traffic accordingly since they will not be in the same network range? And from 172.17.1.0/24 be able to access 172.16.0.0/16? sounds easier than taking this side down to a /24..
Business Accounts
Answer for Membership
by: jmlambPosted on 2009-09-08 at 09:35:29ID: 25283594
You don't need 1-to-1 NAT in the tunnel if you want traffic to flow freely between the networks. In the tunnel configuration, on each side, make sure the local and remote network information is correct.
Main 750
172.16.0.0/16 <==> 172.16.40.0/24
Remote 750
172.16.40.0/24 <==> 172.16.0.0/16
Policy manager will automatically create a bovpn rule for the connection.