MUVPN cannot ping across BOVPN

We have 3 fireboxes conneted via BOVPN which is working fine. We are able to access servers across the BOVPN when on the trusted network. The problem is when I VPN in via the MUVPN IPSEC to one of the fireboxes, I cannot ping across the BOVPN.

The MUVPN rule is set to ANY, and the IP address pool that it is giving out is on the same subnet as the trusted LAN. Given these factors I should be able to ping the servers across the BOVPN but this is not the case.

Is there anything that I am missing?
LVL 1
bdragunAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
dpk_walConnect With a Mentor Commented:
While configuring the MUVPN client; edit the user/group; under resources tab, do you have the checkbox "Force All Traffic Through Tunnel" checked; if not you would need to check it.

After you check the box; you would need to re-generate the files and distribute to clients so the changes are uploaded in the client. Till that time the users would not be able to connect to firebox using MUVPN.

Let's see why this is needed and what are the drawbacks of this approach, I will take an example to explain.

Let's say the setup is as below:

              192.168.1.0/24 Internal network---Firebox A----VPN --Site B --- 192.168,2,0/24
                                                                                       |            |
                                                        192.168.3.0/24  Site C       Site D --- 192.168.4.0/24
The remote client when connects using MUVPN is assigned IP address in the range 192.168.1.100. And let's say under allowed resources you only have 192.168.1.0/24; this would mean the traffic from the remote client would only be put on tunnel when it is destined for 192.168.1.0/24 subnet.
After we make the change and check the box; then all the traffic including the internet traffic would first come to the firebox; firebox already has policy allowing all traffic from the remote client; further firebox also has policies to route traffic between 192.168.1.0/24 and other subnets (.2.0; .3.0 and .4.0).
With all the traffic including internet traffic coming to firebox over the VPN tunnel and then to the internet and then through VPN tunnel back to user; the latency for internet traffic would increase considerably. In some cases the remote user might not be able to access local shared drives till the VPN connection is closed.

Please implement and update.

Thank you.
0
 
ShmoidCommented:
On the VPN client do you have "use default gateway on remote network" unchecked?

To find out:
Right click the VPN connection
Select Properties
Click Networking Tab
Select TCP/IP in the list
Click the properties button
Click the advanced button.

I normally keep it unchecked unless I need to map a drive to  a server at one of our remote sites. That way I'm accessing the Internet through my ISP rather than the VPN.
0
 
bdragunAuthor Commented:
I made the change and forced all traffic through the firewall and it is working. Do we have to use this method? Can it be setup so that a user can use thier local internet access instead of being forced through the firebox?
0
The eGuide to Automating Firewall Change Control

Today‚Äôs IT environment is constantly changing, which affects security policies and firewall rules. Discover tips to help you embrace this change through process improvement & identify areas where automation & actionable intelligence can enhance both security and business agility.

 
dpk_walCommented:
Under allowed resources; you can add specific subnet and try; again reload the updated policy on the client.

Please implement and update.

Thank you.
0
 
dpk_walCommented:
Sorry forgot to add, uncheck force all traffic checkbox.
0
 
bdragunAuthor Commented:
well like I said when I force traffic it works but when I unchecked the force traffic through tunnel and it doesn't seem to want to work. At first I thought it might be because of the subnet I am on, but I tried from a Sprint Air card and I am having the same issue.
Going to try a couple different configs and test them out. Also plan to upgrade the firmware to the most recent.
0
 
dpk_walCommented:
Upgrading firware would not help; as I explained earlier either you configure zero route tunnel or add multiple subnets in the allowed resrouces.

After you uncheck the box; can you specify under allowed resources; what do you have.

Thank you.
0
All Courses

From novice to tech pro — start learning today.