[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now


MUVPN cannot ping across BOVPN

Posted on 2008-10-10
Medium Priority
Last Modified: 2015-09-16
We have 3 fireboxes conneted via BOVPN which is working fine. We are able to access servers across the BOVPN when on the trusted network. The problem is when I VPN in via the MUVPN IPSEC to one of the fireboxes, I cannot ping across the BOVPN.

The MUVPN rule is set to ANY, and the IP address pool that it is giving out is on the same subnet as the trusted LAN. Given these factors I should be able to ping the servers across the BOVPN but this is not the case.

Is there anything that I am missing?
Question by:bdragun
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2

Expert Comment

ID: 22687000
On the VPN client do you have "use default gateway on remote network" unchecked?

To find out:
Right click the VPN connection
Select Properties
Click Networking Tab
Select TCP/IP in the list
Click the properties button
Click the advanced button.

I normally keep it unchecked unless I need to map a drive to  a server at one of our remote sites. That way I'm accessing the Internet through my ISP rather than the VPN.
LVL 32

Accepted Solution

dpk_wal earned 500 total points
ID: 22688575
While configuring the MUVPN client; edit the user/group; under resources tab, do you have the checkbox "Force All Traffic Through Tunnel" checked; if not you would need to check it.

After you check the box; you would need to re-generate the files and distribute to clients so the changes are uploaded in the client. Till that time the users would not be able to connect to firebox using MUVPN.

Let's see why this is needed and what are the drawbacks of this approach, I will take an example to explain.

Let's say the setup is as below:

     Internal network---Firebox A----VPN --Site B --- 192.168,2,0/24
                                                                                       |            |
                                                Site C       Site D ---
The remote client when connects using MUVPN is assigned IP address in the range And let's say under allowed resources you only have; this would mean the traffic from the remote client would only be put on tunnel when it is destined for subnet.
After we make the change and check the box; then all the traffic including the internet traffic would first come to the firebox; firebox already has policy allowing all traffic from the remote client; further firebox also has policies to route traffic between and other subnets (.2.0; .3.0 and .4.0).
With all the traffic including internet traffic coming to firebox over the VPN tunnel and then to the internet and then through VPN tunnel back to user; the latency for internet traffic would increase considerably. In some cases the remote user might not be able to access local shared drives till the VPN connection is closed.

Please implement and update.

Thank you.

Author Comment

ID: 22689844
I made the change and forced all traffic through the firewall and it is working. Do we have to use this method? Can it be setup so that a user can use thier local internet access instead of being forced through the firebox?
Looking for the Wi-Fi vendor that's right for you?

We know how difficult it can be to evaluate Wi-Fi vendors, so we created this helpful Wi-Fi Buyer's Guide to help you find the Wi-Fi vendor that's right for your business! Download the guide and get started on our checklist today!

LVL 32

Expert Comment

ID: 22690235
Under allowed resources; you can add specific subnet and try; again reload the updated policy on the client.

Please implement and update.

Thank you.
LVL 32

Expert Comment

ID: 22690258
Sorry forgot to add, uncheck force all traffic checkbox.

Author Comment

ID: 22702323
well like I said when I force traffic it works but when I unchecked the force traffic through tunnel and it doesn't seem to want to work. At first I thought it might be because of the subnet I am on, but I tried from a Sprint Air card and I am having the same issue.
Going to try a couple different configs and test them out. Also plan to upgrade the firmware to the most recent.
LVL 32

Expert Comment

ID: 22702840
Upgrading firware would not help; as I explained earlier either you configure zero route tunnel or add multiple subnets in the allowed resrouces.

After you uncheck the box; can you specify under allowed resources; what do you have.

Thank you.

Featured Post

2017 Webroot Threat Report

MSPs: Get the facts you need to protect your clients.
The 2017 Webroot Threat Report provides a uniquely insightful global view into the analysis and discoveries made by the Webroot® Threat Intelligence Platform to provide insights on key trends and risks as seen by our users.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you are like regular user of computer nowadays, a good bet that your home computer is on right now, all exposed to world of Internet to be exploited by somebody you do not know and you never will. Internet security issues has been getting worse d…
To setup a SonicWALL for policy based routing to be used with the Websense Content Gateway there are several steps that need to be completed. Below is a rough guide for accomplishing this. One thing of note is this guide is intended to assist in the…
Visualize your data even better in Access queries. Given a date and a value, this lesson shows how to compare that value with the previous value, calculate the difference, and display a circle if the value is the same, an up triangle if it increased…
In this video, Percona Solutions Engineer Barrett Chambers discusses some of the basic syntax differences between MySQL and MongoDB. To learn more check out our webinar on MongoDB administration for MySQL DBA: https://www.percona.com/resources/we…
Suggested Courses

656 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question