Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 790
  • Last Modified:

After I connect to my Cisco VPN Client I cannot ping anything on the LAN

Ok here's my issue.  Remote users connect to my network via the Cisco VPN Client.  My remote access VPN is configured on a Cisco VPN Concentrator 3060.  Attached is network diagram showing my network.  I changed my address pool on my VPN Concentrator, because I wanted it to hand out ip addresses in a different ip block.  So as you can see when remote users connect to the VPN they get an address in the 192.168.87.0/24 range as depicted on my network diagram.  Once connected I can ping both the inside interface and outside interface of the Cisco VPN concentrator, but I cannot ping anything else in my LAN (switches, servers, workstations, etc).  I know this is because my LAN is on a 10.0.0.0/20 network, and the addresses my remote users are getting after connecting to the cisco VPN Client is in the 192.168.87.0/24 network.  Any Assistance would be greatly appreciated.  Thanks.
0
denver218
Asked:
denver218
1 Solution
 
denver218Author Commented:
Sorry I forgot the attach the network diagram.  Thanks. Network Diagram
0
 
pony10usCommented:
1. Are the VPN users able to access the devices in the 10.0.0.0/20 network? Can they RDP to a device?

2. Do you have ICMP permited between the two networks on the Cisco 3060?
0
 
expert02232010Commented:
Have you created a route on your internal network that routes the 192.168.87.0 subnet to the VPN Concentrator?
0
The IT Degree for Career Advancement

Earn your B.S. in Network Operations and Security and become a network and IT security expert. This WGU degree program curriculum was designed with tech-savvy, self-motivated students in mind – allowing you to use your technical expertise, to address real-world business problems.

 
MikehydeCommented:
A VPN concentrator is not a router. As you now have users in a different subnet, they cannot talk to anyone who is NOT in their local subnet (192.x).

You can ping the interfaces as theya re directly connected and do not need to be routed.

The solution is to give them IP's in the range.

The alternate (harder situation) is to add in routing. You can do this a variety of ways. If you have a current router with available interfaces, you can put a leg into each subnet. No config would be required as the subnets are directly attached and the router would know where to route.

If you have a VLAN capable Layer3 router (not enhanced layer2), you could also use VLAN's which will route traffic.

I could not find an attached diagram so this is my best with knowing more specifics. It is not broekn, this is the default behavior expected. You need routing if you have different subnets.

NOTE: Even Layer2 routers with VLANS cant route traffic on the same device. This haunted us in the past as you could make vlans but they couldnt talk to each other. You had to "hang a L3 router off the device, essentially telling it to route traffic for vlans. This was called router-on-a-stick and was the lamest thing ever.
0
 
denver218Author Commented:
No users cannot access devices in the 10.0.0.0/20 network.  Once connected to the concentor, I can ping 10.0.0.5, which is the inside interface of the concentrator, and I can ping 192.168.50.2, which is the outside interface of the concentrator.
0
 
denver218Author Commented:
My requirement is not to have the concentrator hand out IPs that are in the same range as the LAN.  I can get it to work without issue if my ip pool on the concentrator is in the same range as my LAN.  I know I'm missing a route statement here somewhere to get this working with a different subnet, I just don't know where.  Thanks.
0
 
MikehydeCommented:
you can ping the interfaces as they are directly connected. This requires no routing. Anyone else can't be pinged as it looks for a route and there is no route defined.

I now see your diagram. Can 172 talk to 10.0?

That ASA5510 may be where you are routing as well.
0
 
denver218Author Commented:
Thats what i needed was a route on my internal network.  On the 3550-12G I added the following route statement:
ip route 192.168.87.0 255.255.255.0 10.0.0.5

After adding this I could ping and RDP into machines on my LAN.   Thanks.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

What Kind of Coding Program is Right for You?

There are many ways to learn to code these days. From coding bootcamps like Flatiron School to online courses to totally free beginner resources. The best way to learn to code depends on many factors, but the most important one is you. See what course is best for you.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now