Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 455
  • Last Modified:

One way traffic over a hardware VPN

Main Site:
Bonded T-1 (3MB)
Watchgurard Firewall (550e)
Small Business Server 2003 with Exchange 2003  Fully patched
35 workstations joined to domain

Site 2 (good working condition through hardware VPN)
Cable (6MBx1MB)
Watchguard Firewall(x10e-w)
5 workstations joined to main site domain

Site 3 (One way traffic through hardware VPN)
Cable (6MBx2MB)  Different company than 2nd site)
Watchguard Firewall  (x10e-w)
Small Business Server 2003  no Exchange 2003 fully patched
4 workstations joined to domain

I can get to the SBS server from site 3 through Outlook connected to exchange and also to file shares.
I cannot remote into a PC at site 3 from the main site.  I can, however, remote into a PC at the main site from site 3.
Also, I cannot ping from the main site to site 3.  

The reason for the ping failure alternates between two statements:

Reply from 192.168.0.1:  Destination host unreachable
Request timed out.
Reply from 192.168.0.1:  Destination host unreachable
Request timed out.

Any help would be greatly appreciated.
0
dcsdave
Asked:
dcsdave
  • 6
  • 3
  • 2
  • +1
3 Solutions
 
AngelGabrielCommented:
What subnets do you use locally at each of the sites?

Site A ->
Site B ->
Site C ->

Are any of them the same? and also the subnet masks?
0
 
dcsdaveAuthor Commented:
Main site:
192.168.0.0/24
Site 2:
192.168.6.0/24
Site 3:
192.168.50.0/24
0
 
tmoore1962Commented:
Your routes are not configured correctly in your main site router or the site 3 router.  You should compare the acl that you have for site 2 and you should have an equivalent acl for site 3, also compare site 2 running config to site 3 running config as they should have acl that correspond to their networks. You will need addtional acls to get traffic from site 2 to 3 and vice versa also.
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
dcsdaveAuthor Commented:
I will check that out tmoore1962 and get back to you.
0
 
Rob WilliamsCommented:
Any chance SBS at site 3 has 2 NIC's?
0
 
dcsdaveAuthor Commented:
RobWill,
There are two NICs in the Site 3 SBS server but one of them is disabled.

Just to clarify,
All VPNs are up and the main router shows Rx and Tx for both remote sites.

The problem in it's most basic form is that I can't get to site 3 from the main office.

Why would traffic only flow one way when I have configured site 3 like site 2 in every way except, obviously the lan?
0
 
Rob WilliamsCommented:
I assume the PC's at site 3 use the VPN router as their default gateway? i.e. have a default return route to site 1.

It could also be a software e firewall or security suite at site 3 blocking access on each PC.
0
 
tmoore1962Commented:
It has to be a routing issue.  Since you are getting a destination unreachable.  Try a pathping from 1 to 3, I am assuming that the router in site 1 is also the firewall for the site.  check the acl's very very carefully. The ACL can look correct but any little syntax will prevent them from working.  FIREWALL DENY by default.
0
 
tmoore1962Commented:
Double check your IPSec tunnels in the Watchguard configuration.  I suspect a syntax error there will also impede traffic in one direction.
0
 
dcsdaveAuthor Commented:
tmoore1962,

My main watchguard reports a destination host unreachable when I try pathping to site 3.

Pathping works fine from main to site 2. (131 ms and 100%)
0
 
dcsdaveAuthor Commented:
tmoore1962,

The tunnels are identical minus the IPs. And as I stated before the tunnels are up and Tx, Rx show bytes being transfered.

I am going to give Watchguard a call and see if they have any insight into the issue also.

Thanks for your continued help.
0
 
dcsdaveAuthor Commented:
It turned out that one of the optional networks on the main watchguard was configured with the same LAN settings as site 3.  Even though I don't use the optional port on the router it must have had a defalt route that was confusing it.

Thanks for all your help!!
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

  • 6
  • 3
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now