Solved

Can ping but can't telnet across tunnel

Posted on 2011-03-15
22
1,730 Views
Last Modified: 2012-05-11
have 2 sites connected via vpn, all part of same AD forest, having issue with mail flow between exchange servers, so i try to telnet from each exchange server to the other on port 25 and it doesn't work, but they each can ping, so i try from the routers which are both cisco 2821, same thing can't telnet from the opposite router across tunnel on 25, but each router can telnet on 25 to its own site exchange server.  i can't see anything that would be preventing, hoping maybe you guys notice something, attached are the configs
courthouse-scrub.txt
resource-scrub.txt
0
Comment
Question by:jasonmichel
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 8
  • 4
  • 3
  • +3
22 Comments
 
LVL 10

Accepted Solution

by:
ThorinO earned 100 total points
ID: 35139700
Sounds like a firewall issue, are you able to telnet to other known open ports? Have you checked the Windows firewall?
0
 
LVL 1

Author Comment

by:jasonmichel
ID: 35139872
i can telnet into the machines just fine from their own location and from outside, just not across the tunnel
0
 
LVL 10

Expert Comment

by:ThorinO
ID: 35140246
Can you telnet to any other ports across the VPN. I am not familiar with Cisco VPN configs but with a SonicWALL it generally acts like a LAN. However you could have another zone created that has some firewall rules in place.
0
How to Defend Against the WCry Ransomware Attack

On May 12, 2017, an extremely virulent ransomware variant named WCry 2.0 began to infect organizations. Within several hours, over 75,000 victims were reported in 90+ countries. Learn more from our research team about this threat & how to protect your organization!

 
LVL 1

Author Comment

by:jasonmichel
ID: 35140256
just a simple ipsec tunnel protected with ACLS
0
 
LVL 17

Assisted Solution

by:MAG03
MAG03 earned 100 total points
ID: 35144760
what are the ip addresses of the exchange servers? and please specify which ip belongs to the main office and which belongs to the remote.
0
 
LVL 1

Author Comment

by:jasonmichel
ID: 35147374
10.15.31.15- main
10.15.100.12- remote
0
 
LVL 12

Assisted Solution

by:profgeek
profgeek earned 100 total points
ID: 35147796
0
 
LVL 17

Expert Comment

by:MAG03
ID: 35148094
you are not permitting the traffic for smtp to  10.15.31.15 and 10.15.100.12 in your nospam access-list and this access list is configured on almost all your interfaces except a couple exceptions.

Which interface connects to the remote office?

Try adding those two to the access-list nospam and test.
0
 
LVL 1

Author Comment

by:jasonmichel
ID: 35148737
the two interfaces don't have that applied, on the remote site it is  gig0/1.100
and on the main site gig0/1.31
0
 
LVL 20

Assisted Solution

by:RPPreacher
RPPreacher earned 100 total points
ID: 35175581
You need to allow port 25 inbound on Windows Server firewall from the remote ip range.
0
 
LVL 1

Author Comment

by:jasonmichel
ID: 35175826
the firewall is turned off, i can telnet on 25 from outside and from any pc on its own lan, just not from one side to the other
0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 35175876
That is usually a Windows firewall issue.  Especially since ping works.  Which version of Windows server are you using?
0
 
LVL 17

Expert Comment

by:John Gates
ID: 35175891
Some kind of firewall must be blocking the ports.  The routing is working as you are able to ICMP Ping and get a response...  If you have no firewalls in place between the two servers then it is time to look at the SMTP configuration and see if you have access restricted there.  Are you restricting access to SMTP by only having your local internal subnet listed?

-D-
0
 
LVL 1

Author Comment

by:jasonmichel
ID: 35177387
both are server 2008, and are you talking on the smtp recieve connector?
0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 35177434
2008 has an inbound & outbound firewall in Windows. Did you open 25 on both?
0
 
LVL 1

Author Comment

by:jasonmichel
ID: 35177439
the servers are sending mail to the outside fine?  so i assume they are open?
0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 35177534
Two different firewalls. Inbound & outbound
0
 
LVL 17

Assisted Solution

by:John Gates
John Gates earned 100 total points
ID: 35179883
I would start looking at the smtp config.  Here's why:  You can ping so you know routing is not the problem.  You are pretty much ruling out the firewall yourself...  So SMTP has to be dropping the connection due to a setting on the SMTP configuration...  Just for grins add the IP range of the remote subnet to the allowed connections SMTP configuration setting.

-D-
0
 
LVL 1

Author Comment

by:jasonmichel
ID: 35180870
you are talking on the recieve connector of each?
0
 
LVL 17

Expert Comment

by:John Gates
ID: 35181019
Yes.  There has to be a restriction that is preventing that connection from occurring.  If you do not have any incoming restrictions set up then The SMTP logs are going to be the next place to look to see why the disconnection is occurring.
0

Featured Post

Connect further...control easier

With the ATEN CE624, you can now enjoy a high-quality visual experience powered by HDBaseT technology and the convenience of a single Cat6 cable to transmit uncompressed video with zero latency and multi-streaming for dual-view applications where remote access is required.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

OpenVPN is a great open source VPN server that is capable of providing quick and easy VPN access to your network on the cheap.  By default the software is configured to allow open access to your network.  But what if you want to restrict users to on…
I had an issue with InstallShield not being able to use Computer Browser service on Windows Server 2012. Here is the solution I found.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

738 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question