MUVPN cannot ping across BOVPN

Posted on 2008-10-10
Last Modified: 2015-09-16
We have 3 fireboxes conneted via BOVPN which is working fine. We are able to access servers across the BOVPN when on the trusted network. The problem is when I VPN in via the MUVPN IPSEC to one of the fireboxes, I cannot ping across the BOVPN.

The MUVPN rule is set to ANY, and the IP address pool that it is giving out is on the same subnet as the trusted LAN. Given these factors I should be able to ping the servers across the BOVPN but this is not the case.

Is there anything that I am missing?
Question by:bdragun
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2

Expert Comment

ID: 22687000
On the VPN client do you have "use default gateway on remote network" unchecked?

To find out:
Right click the VPN connection
Select Properties
Click Networking Tab
Select TCP/IP in the list
Click the properties button
Click the advanced button.

I normally keep it unchecked unless I need to map a drive to  a server at one of our remote sites. That way I'm accessing the Internet through my ISP rather than the VPN.
LVL 32

Accepted Solution

dpk_wal earned 125 total points
ID: 22688575
While configuring the MUVPN client; edit the user/group; under resources tab, do you have the checkbox "Force All Traffic Through Tunnel" checked; if not you would need to check it.

After you check the box; you would need to re-generate the files and distribute to clients so the changes are uploaded in the client. Till that time the users would not be able to connect to firebox using MUVPN.

Let's see why this is needed and what are the drawbacks of this approach, I will take an example to explain.

Let's say the setup is as below:

     Internal network---Firebox A----VPN --Site B --- 192.168,2,0/24
                                                                                       |            |
                                                Site C       Site D ---
The remote client when connects using MUVPN is assigned IP address in the range And let's say under allowed resources you only have; this would mean the traffic from the remote client would only be put on tunnel when it is destined for subnet.
After we make the change and check the box; then all the traffic including the internet traffic would first come to the firebox; firebox already has policy allowing all traffic from the remote client; further firebox also has policies to route traffic between and other subnets (.2.0; .3.0 and .4.0).
With all the traffic including internet traffic coming to firebox over the VPN tunnel and then to the internet and then through VPN tunnel back to user; the latency for internet traffic would increase considerably. In some cases the remote user might not be able to access local shared drives till the VPN connection is closed.

Please implement and update.

Thank you.

Author Comment

ID: 22689844
I made the change and forced all traffic through the firewall and it is working. Do we have to use this method? Can it be setup so that a user can use thier local internet access instead of being forced through the firebox?
The Ultimate Checklist to Optimize Your Website

Websites are getting bigger and complicated by the day. Video, images, custom fonts are all great for showcasing your product/service. But the price to pay in terms of reduced page load times and ultimately, decreased sales, can lead to some difficult decisions about what to cut.

LVL 32

Expert Comment

ID: 22690235
Under allowed resources; you can add specific subnet and try; again reload the updated policy on the client.

Please implement and update.

Thank you.
LVL 32

Expert Comment

ID: 22690258
Sorry forgot to add, uncheck force all traffic checkbox.

Author Comment

ID: 22702323
well like I said when I force traffic it works but when I unchecked the force traffic through tunnel and it doesn't seem to want to work. At first I thought it might be because of the subnet I am on, but I tried from a Sprint Air card and I am having the same issue.
Going to try a couple different configs and test them out. Also plan to upgrade the firmware to the most recent.
LVL 32

Expert Comment

ID: 22702840
Upgrading firware would not help; as I explained earlier either you configure zero route tunnel or add multiple subnets in the allowed resrouces.

After you uncheck the box; can you specify under allowed resources; what do you have.

Thank you.

Featured Post

Raise the IQ of Your IT Alerts

From IT major incidents to manufacturing line slowdowns, every business process generates insights that need to reach the people required to take action. You need a platform that integrates with your business tools to create fully enabled DevOps toolchains.

You need xMatters.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Wikipedia defines 'Script Kiddies' in this informal way: "In hacker culture, a script kiddie, occasionally script bunny, skiddie, script kitty, script-running juvenile (SRJ), or similar, is a derogatory term used to describe those who use scripts or…
To setup a SonicWALL for policy based routing to be used with the Websense Content Gateway there are several steps that need to be completed. Below is a rough guide for accomplishing this. One thing of note is this guide is intended to assist in the…
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor ( Top Charts is a view in which you can set seve…
If you’ve ever visited a web page and noticed a cool font that you really liked the look of, but couldn’t figure out which font it was so that you could use it for your own work, then this video is for you! In this Micro Tutorial, you'll learn yo…

690 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question