After I connect to my Cisco VPN Client I cannot ping anything on the LAN

Ok here's my issue.  Remote users connect to my network via the Cisco VPN Client.  My remote access VPN is configured on a Cisco VPN Concentrator 3060.  Attached is network diagram showing my network.  I changed my address pool on my VPN Concentrator, because I wanted it to hand out ip addresses in a different ip block.  So as you can see when remote users connect to the VPN they get an address in the 192.168.87.0/24 range as depicted on my network diagram.  Once connected I can ping both the inside interface and outside interface of the Cisco VPN concentrator, but I cannot ping anything else in my LAN (switches, servers, workstations, etc).  I know this is because my LAN is on a 10.0.0.0/20 network, and the addresses my remote users are getting after connecting to the cisco VPN Client is in the 192.168.87.0/24 network.  Any Assistance would be greatly appreciated.  Thanks.
LVL 4
denver218Asked:
Who is Participating?
 
expert02232010Connect With a Mentor Commented:
Have you created a route on your internal network that routes the 192.168.87.0 subnet to the VPN Concentrator?
0
 
denver218Author Commented:
Sorry I forgot the attach the network diagram.  Thanks. Network Diagram
0
 
pony10usCommented:
1. Are the VPN users able to access the devices in the 10.0.0.0/20 network? Can they RDP to a device?

2. Do you have ICMP permited between the two networks on the Cisco 3060?
0
Get Cisco Certified in IT Security

There’s a high demand for IT security experts and network administrators who can safeguard the data that individuals, corporations, and governments rely on every day. Pursue your B.S. in Network Operations and Security and gain the credentials you need for this high-growth field.

 
MikehydeCommented:
A VPN concentrator is not a router. As you now have users in a different subnet, they cannot talk to anyone who is NOT in their local subnet (192.x).

You can ping the interfaces as theya re directly connected and do not need to be routed.

The solution is to give them IP's in the range.

The alternate (harder situation) is to add in routing. You can do this a variety of ways. If you have a current router with available interfaces, you can put a leg into each subnet. No config would be required as the subnets are directly attached and the router would know where to route.

If you have a VLAN capable Layer3 router (not enhanced layer2), you could also use VLAN's which will route traffic.

I could not find an attached diagram so this is my best with knowing more specifics. It is not broekn, this is the default behavior expected. You need routing if you have different subnets.

NOTE: Even Layer2 routers with VLANS cant route traffic on the same device. This haunted us in the past as you could make vlans but they couldnt talk to each other. You had to "hang a L3 router off the device, essentially telling it to route traffic for vlans. This was called router-on-a-stick and was the lamest thing ever.
0
 
denver218Author Commented:
No users cannot access devices in the 10.0.0.0/20 network.  Once connected to the concentor, I can ping 10.0.0.5, which is the inside interface of the concentrator, and I can ping 192.168.50.2, which is the outside interface of the concentrator.
0
 
denver218Author Commented:
My requirement is not to have the concentrator hand out IPs that are in the same range as the LAN.  I can get it to work without issue if my ip pool on the concentrator is in the same range as my LAN.  I know I'm missing a route statement here somewhere to get this working with a different subnet, I just don't know where.  Thanks.
0
 
MikehydeCommented:
you can ping the interfaces as they are directly connected. This requires no routing. Anyone else can't be pinged as it looks for a route and there is no route defined.

I now see your diagram. Can 172 talk to 10.0?

That ASA5510 may be where you are routing as well.
0
 
denver218Author Commented:
Thats what i needed was a route on my internal network.  On the 3550-12G I added the following route statement:
ip route 192.168.87.0 255.255.255.0 10.0.0.5

After adding this I could ping and RDP into machines on my LAN.   Thanks.
0
All Courses

From novice to tech pro — start learning today.