Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

VPN working, but they can't ping our internal network

Posted on 2006-07-14
16
848 Views
Last Modified: 2013-11-16
We have the following VPN path setup with an outside vendor:

[them]----[internet]----[our firewall]----[switch]----[domain controller, internal network, etc]

The VPN (ipsec) tunnel has been established and they can ping our firewall box, and we can ping them, but they can't ping anything past the firewall.  They're trying to ping an internal networked printer but get timed out.  I can ping to theirs just fine.

Since they can ping the firewall itself, I'm assuming something is holding it up at the domain controller level.  What do I need to check to allow them to ping internal machines?

Kevin
0
Comment
Question by:Kevin Smith
  • 3
  • 3
  • 2
  • +6
16 Comments
 
LVL 20

Accepted Solution

by:
RPPreacher earned 66 total points
ID: 17110598
You need an access list permitting traffic from the firewall to the internal network
0
 
LVL 3

Assisted Solution

by:wingspin
wingspin earned 62 total points
ID: 17110609
It could be several things.  
I'd check the default gateway setting of the remote VPN client.  The external IP address of the firewall won't do it.  It depends your setup as to what the gateway IP address should be.  You can try making their own IP address if you're stumped.

Is the VPN port NAT-ed to your domain controller?  

Are you running the Win-logon script after the VPN connects?  



0
 
LVL 2

Assisted Solution

by:just-one-it
just-one-it earned 62 total points
ID: 17110819
What type of vpn are you using?  Is the IP assigned to the vpn client in the same subnet as the printer they are trying to ping?
0
Easy, flexible multimedia distribution & control

Coming soon!  Ideal for large-scale A/V applications, ATEN's VM3200 Modular Matrix Switch is an all-in-one solution that simplifies video wall integration. Easily customize display layouts to see what you want, how you want it in 4k.

 
LVL 22

Assisted Solution

by:Rick Hobbs
Rick Hobbs earned 62 total points
ID: 17110863
What type of firewall?  What is you VPN client?
0
 
LVL 2

Expert Comment

by:just-one-it
ID: 17110887
Is there an echo in here? ;)
0
 
LVL 9

Assisted Solution

by:NYtechGuy
NYtechGuy earned 62 total points
ID: 17110921

It may also be routing:

- Is your network only one subnet, or are there other subnets/routers involved behind your firewall?  They may not have the necessary routes.
0
 
LVL 25

Assisted Solution

by:Ron Malmstead
Ron Malmstead earned 62 total points
ID: 17111507
Check my previously answered question on expertsexchange.

http://www.experts-exchange.com/Networking/Q_21774941.html

It may apply to you also.

Good luck.
0
 
LVL 77

Assisted Solution

by:Rob Williams
Rob Williams earned 62 total points
ID: 17111593
Is the "firewall box" the default gateway for the devices you are trying to ping.
i.e. is the firewall box's LAN IP the added to the printer's configuration as it's gateway?
Also, the local and remote LAN subnets need to be different for the VPN.
0
 

Author Comment

by:Kevin Smith
ID: 17111605
Yes, the box is the the default gateway, but he can't ping any machine even if it is configured with the default gateway.
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 17111647
-Are the subnets different ? The 2 LAN's should be.
-Are "they" pinging the LAN or the WAN IP of the firewall ?
-perhaps as asked earlier if you could provide more information as to the VPN configuration such as hardware make and model, and the client you are using, we could better assist.
0
 
LVL 7

Assisted Solution

by:nttranbao
nttranbao earned 62 total points
ID: 17120155
from "them", open command promt and use tracert or pathping to trace the route. See whiere it stops responding.

I guess this is because of the firewall NOT allow ICMP from outside into the internal network. There would be nothing to do with routing since your internal network can ping "them" successfully.

If possible , tell us what kind of your Firewall? a computer or a cisco?
0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 17120732
Did you ever add an access-list?  It was the first suggestion and a very common issue with VPN connectivity issues.
0
 

Author Comment

by:Kevin Smith
ID: 17140637
The problem "fixed itself", althought I didn't do anything (guessing it might have been something on their end after all).  I didn't use any of the answers above, but did learn some things so I'm gonna split up the points to everybody if that's cool.
0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 17140643
Thanks.  Glad it resolved.
0
 
LVL 22

Expert Comment

by:Rick Hobbs
ID: 17141608
Glad I could be of assistance. Thanks!
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 17142005
Thanks ksmithscs,
--Rob
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
How to read network slash info 7 44
Interface traffic report in FortiAnalyzer 1000D 4 23
Home firewall recommendations 11 52
Price for Fiber 13 29
If your business is like most, chances are you still need to maintain a fax infrastructure for your staff. It’s hard to believe that a communication technology that was thriving in the mid-80s could still be an essential part of your team’s modern I…
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question