?
Solved

After I connect to my Cisco VPN Client I cannot ping anything on the LAN

Posted on 2011-03-14
8
Medium Priority
?
786 Views
Last Modified: 2012-05-11
Ok here's my issue.  Remote users connect to my network via the Cisco VPN Client.  My remote access VPN is configured on a Cisco VPN Concentrator 3060.  Attached is network diagram showing my network.  I changed my address pool on my VPN Concentrator, because I wanted it to hand out ip addresses in a different ip block.  So as you can see when remote users connect to the VPN they get an address in the 192.168.87.0/24 range as depicted on my network diagram.  Once connected I can ping both the inside interface and outside interface of the Cisco VPN concentrator, but I cannot ping anything else in my LAN (switches, servers, workstations, etc).  I know this is because my LAN is on a 10.0.0.0/20 network, and the addresses my remote users are getting after connecting to the cisco VPN Client is in the 192.168.87.0/24 network.  Any Assistance would be greatly appreciated.  Thanks.
0
Comment
Question by:denver218
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
8 Comments
 
LVL 4

Author Comment

by:denver218
ID: 35130952
Sorry I forgot the attach the network diagram.  Thanks. Network Diagram
0
 
LVL 26

Expert Comment

by:pony10us
ID: 35130993
1. Are the VPN users able to access the devices in the 10.0.0.0/20 network? Can they RDP to a device?

2. Do you have ICMP permited between the two networks on the Cisco 3060?
0
 
LVL 6

Accepted Solution

by:
expert02232010 earned 2000 total points
ID: 35130997
Have you created a route on your internal network that routes the 192.168.87.0 subnet to the VPN Concentrator?
0
The Ideal Solution for Multi-Display Applications

Check out ATEN’s VS1912 12-Port DP Video Wall Media Player at InfoComm 2017. Kerri describes how easy it is to design creative video walls in asymmetric layouts and schedule detailed playlists ahead of time with its advanced scheduling feature.

 
LVL 1

Expert Comment

by:Mikehyde
ID: 35131025
A VPN concentrator is not a router. As you now have users in a different subnet, they cannot talk to anyone who is NOT in their local subnet (192.x).

You can ping the interfaces as theya re directly connected and do not need to be routed.

The solution is to give them IP's in the range.

The alternate (harder situation) is to add in routing. You can do this a variety of ways. If you have a current router with available interfaces, you can put a leg into each subnet. No config would be required as the subnets are directly attached and the router would know where to route.

If you have a VLAN capable Layer3 router (not enhanced layer2), you could also use VLAN's which will route traffic.

I could not find an attached diagram so this is my best with knowing more specifics. It is not broekn, this is the default behavior expected. You need routing if you have different subnets.

NOTE: Even Layer2 routers with VLANS cant route traffic on the same device. This haunted us in the past as you could make vlans but they couldnt talk to each other. You had to "hang a L3 router off the device, essentially telling it to route traffic for vlans. This was called router-on-a-stick and was the lamest thing ever.
0
 
LVL 4

Author Comment

by:denver218
ID: 35131043
No users cannot access devices in the 10.0.0.0/20 network.  Once connected to the concentor, I can ping 10.0.0.5, which is the inside interface of the concentrator, and I can ping 192.168.50.2, which is the outside interface of the concentrator.
0
 
LVL 4

Author Comment

by:denver218
ID: 35131110
My requirement is not to have the concentrator hand out IPs that are in the same range as the LAN.  I can get it to work without issue if my ip pool on the concentrator is in the same range as my LAN.  I know I'm missing a route statement here somewhere to get this working with a different subnet, I just don't know where.  Thanks.
0
 
LVL 1

Expert Comment

by:Mikehyde
ID: 35131149
you can ping the interfaces as they are directly connected. This requires no routing. Anyone else can't be pinged as it looks for a route and there is no route defined.

I now see your diagram. Can 172 talk to 10.0?

That ASA5510 may be where you are routing as well.
0
 
LVL 4

Author Closing Comment

by:denver218
ID: 35131237
Thats what i needed was a route on my internal network.  On the 3550-12G I added the following route statement:
ip route 192.168.87.0 255.255.255.0 10.0.0.5

After adding this I could ping and RDP into machines on my LAN.   Thanks.
0

Featured Post

On Demand Webinar: Networking for the Cloud Era

Ready to improve network connectivity? Watch this webinar to learn how SD-WANs and a one-click instant connect tool can boost provisions, deployment, and management of your cloud connection.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Use of TCL script on Cisco devices:  - create file and merge it with running configuration to apply configuration changes
Concerto Cloud Services, a provider of fully managed private, public and hybrid cloud solutions, announced today it was named to the 20 Coolest Cloud Infrastructure Vendors Of The 2017 Cloud  (http://www.concertocloud.com/about/in-the-news/2017/02/0…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Suggested Courses

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question