?
Solved

MUVPN cannot ping across BOVPN

Posted on 2008-10-10
7
Medium Priority
?
1,468 Views
Last Modified: 2015-09-16
We have 3 fireboxes conneted via BOVPN which is working fine. We are able to access servers across the BOVPN when on the trusted network. The problem is when I VPN in via the MUVPN IPSEC to one of the fireboxes, I cannot ping across the BOVPN.

The MUVPN rule is set to ANY, and the IP address pool that it is giving out is on the same subnet as the trusted LAN. Given these factors I should be able to ping the servers across the BOVPN but this is not the case.

Is there anything that I am missing?
0
Comment
Question by:bdragun
  • 4
  • 2
7 Comments
 
LVL 8

Expert Comment

by:Shmoid
ID: 22687000
On the VPN client do you have "use default gateway on remote network" unchecked?

To find out:
Right click the VPN connection
Select Properties
Click Networking Tab
Select TCP/IP in the list
Click the properties button
Click the advanced button.

I normally keep it unchecked unless I need to map a drive to  a server at one of our remote sites. That way I'm accessing the Internet through my ISP rather than the VPN.
0
 
LVL 32

Accepted Solution

by:
dpk_wal earned 500 total points
ID: 22688575
While configuring the MUVPN client; edit the user/group; under resources tab, do you have the checkbox "Force All Traffic Through Tunnel" checked; if not you would need to check it.

After you check the box; you would need to re-generate the files and distribute to clients so the changes are uploaded in the client. Till that time the users would not be able to connect to firebox using MUVPN.

Let's see why this is needed and what are the drawbacks of this approach, I will take an example to explain.

Let's say the setup is as below:

              192.168.1.0/24 Internal network---Firebox A----VPN --Site B --- 192.168,2,0/24
                                                                                       |            |
                                                        192.168.3.0/24  Site C       Site D --- 192.168.4.0/24
The remote client when connects using MUVPN is assigned IP address in the range 192.168.1.100. And let's say under allowed resources you only have 192.168.1.0/24; this would mean the traffic from the remote client would only be put on tunnel when it is destined for 192.168.1.0/24 subnet.
After we make the change and check the box; then all the traffic including the internet traffic would first come to the firebox; firebox already has policy allowing all traffic from the remote client; further firebox also has policies to route traffic between 192.168.1.0/24 and other subnets (.2.0; .3.0 and .4.0).
With all the traffic including internet traffic coming to firebox over the VPN tunnel and then to the internet and then through VPN tunnel back to user; the latency for internet traffic would increase considerably. In some cases the remote user might not be able to access local shared drives till the VPN connection is closed.

Please implement and update.

Thank you.
0
 
LVL 1

Author Comment

by:bdragun
ID: 22689844
I made the change and forced all traffic through the firewall and it is working. Do we have to use this method? Can it be setup so that a user can use thier local internet access instead of being forced through the firebox?
0
The Firewall Audit Checklist

Preparing for a firewall audit today is almost impossible.
AlgoSec, together with some of the largest global organizations and auditors, has created a checklist to follow when preparing for your firewall audit. Simplify risk mitigation while staying compliant all of the time!

 
LVL 32

Expert Comment

by:dpk_wal
ID: 22690235
Under allowed resources; you can add specific subnet and try; again reload the updated policy on the client.

Please implement and update.

Thank you.
0
 
LVL 32

Expert Comment

by:dpk_wal
ID: 22690258
Sorry forgot to add, uncheck force all traffic checkbox.
0
 
LVL 1

Author Comment

by:bdragun
ID: 22702323
well like I said when I force traffic it works but when I unchecked the force traffic through tunnel and it doesn't seem to want to work. At first I thought it might be because of the subnet I am on, but I tried from a Sprint Air card and I am having the same issue.
Going to try a couple different configs and test them out. Also plan to upgrade the firmware to the most recent.
0
 
LVL 32

Expert Comment

by:dpk_wal
ID: 22702840
Upgrading firware would not help; as I explained earlier either you configure zero route tunnel or add multiple subnets in the allowed resrouces.

After you uncheck the box; can you specify under allowed resources; what do you have.

Thank you.
0

Featured Post

Firewall Management 201 with Professor Wool

In this whiteboard video, Professor Wool highlights the challenges, benefits and trade-offs of utilizing zero-touch automation for security policy change management. Watch and Learn!

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Wikipedia defines 'Script Kiddies' in this informal way: "In hacker culture, a script kiddie, occasionally script bunny, skiddie, script kitty, script-running juvenile (SRJ), or similar, is a derogatory term used to describe those who use scripts or…
To setup a SonicWALL for policy based routing to be used with the Websense Content Gateway there are several steps that need to be completed. Below is a rough guide for accomplishing this. One thing of note is this guide is intended to assist in the…
When cloud platforms entered the scene, users and companies jumped on board to take advantage of the many benefits, like the ability to work and connect with company information from various locations. What many didn't foresee was the increased risk…
Free Data Recovery software is an advanced solution from Kernel Tools to recover data and files such as documents, emails, database, media and pictures, etc. It supports recovery from physical & logical drive after a hard disk crash, accidental/inte…

589 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question