WatchGuard announces the acquisition of advanced authentication provider, Datablink, with one mission – to bring secure authentication to SMB, mid-market, and distributed enterprises with a cloud-based solution, ideal for resale via their established channel & MSSP community.
COURSE of the MONTH
10 days, 17 hours left to enrollBecome a Premium Member and unlock a new, free course in leading technologies each month.
Solved
Remote Access VPN - Odd Routing Issue
Posted on 2012-12-20
I have a single user having an issue connecting from their house via the Cisco VPN Client to our corporate network which has an ASA 5510 head end.
Her local subnet is 192.168.1.0/24 and she connects fine and obtains an IP address in the address block reserved for remote access clients, however there is no communication over the link though TX and RX show data moving.
If I do a traceroute from her computer to the corporate network, I see real oddities (attached). I also attached her routing table which looks good.
The only gotcha I can think of, though it shouldn't make a difference to my knowledge, is that we also have a site-to-site VPN tunnel that connects to a 192.168.1.0/24 subnet, but since remote access clients grab from their own DHCP pool, I don't think this should matter?
Any ideas on this?
traceroute.PNG
routing-table.PNG
Her local subnet is 192.168.1.0/24 and she connects fine and obtains an IP address in the address block reserved for remote access clients, however there is no communication over the link though TX and RX show data moving.
If I do a traceroute from her computer to the corporate network, I see real oddities (attached). I also attached her routing table which looks good.
The only gotcha I can think of, though it shouldn't make a difference to my knowledge, is that we also have a site-to-site VPN tunnel that connects to a 192.168.1.0/24 subnet, but since remote access clients grab from their own DHCP pool, I don't think this should matter?
Any ideas on this?
traceroute.PNG
routing-table.PNG
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
-
5
-
2
8 Comments
Active today
Is the 172.30.11.x network the one used for 192.168.1.0 in the site-2-site connection? And what is 10.141.78.1?
First hop should be 10.1.201.1 not 192.168.1.1. Can you adjust the metric for the routed vpn networks to be less than the default route?
That's what I'm wondering Qlemo... none of those networks are used anywhere within our corporate network that does span about 50 subnets. Very odd...
Good idea djcanter, though the routing table shows which hop to contact for that route... that should take precedence over a metic.
Good idea djcanter, though the routing table shows which hop to contact for that route... that should take precedence over a metic.
Your traffic egressing the 192.168.1.1 gateway is hopping on the ISPs private routed network. Clearly they shouldnt allow this....
Routing table should look like below with tunnel routes lower metric than default gateway:
Other sites have reported enabling NAT-T may resolve this
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.10 20
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.1.0 255.255.255.0 192.168.1.10 192.168.1.10 20
192.168.1.10 255.255.255.255 127.0.0.1 127.0.0.1 20
192.168.1.255 255.255.255.255 192.168.1.10 192.168.1.10 20
224.0.0.0 240.0.0.0 192.168.1.10 192.168.1.10 20
255.255.255.255 255.255.255.255 192.168.1.10 192.168.1.10 1
Default Gateway: 192.168.1.1
==========================
Persistent Routes:
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.10 20
10.1.0.0 255.255.255.0 172.20.10.62 172.20.10.62 1
10.2.0.0 255.255.255.0 172.20.10.62 172.20.10.62 1
65.216.9.229 255.255.255.255 192.168.1.1 192.168.1.10 1
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
172.20.10.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.10.62 255.255.255.255 127.0.0.1 127.0.0.1 20
172.20.11.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.21.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.31.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.50.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.51.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.60.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.61.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.70.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.71.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.81.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.91.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.255.255 255.255.255.255 172.20.10.62 172.20.10.62 20
192.168.1.0 255.255.255.0 192.168.1.10 192.168.1.10 20
192.168.1.1 255.255.255.255 192.168.1.10 192.168.1.10 1
192.168.1.10 255.255.255.255 127.0.0.1 127.0.0.1 20
192.168.1.255 255.255.255.255 192.168.1.10 192.168.1.10 20
224.0.0.0 240.0.0.0 172.20.10.62 172.20.10.62 20
224.0.0.0 240.0.0.0 192.168.1.10 192.168.1.10 20
255.255.255.255 255.255.255.255 172.20.10.62 172.20.10.62 1
255.255.255.255 255.255.255.255 192.168.1.10 192.168.1.10 1
Default Gateway: 192.168.1.1
Other sites have reported enabling NAT-T may resolve this
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.10 20
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.1.0 255.255.255.0 192.168.1.10 192.168.1.10 20
192.168.1.10 255.255.255.255 127.0.0.1 127.0.0.1 20
192.168.1.255 255.255.255.255 192.168.1.10 192.168.1.10 20
224.0.0.0 240.0.0.0 192.168.1.10 192.168.1.10 20
255.255.255.255 255.255.255.255 192.168.1.10 192.168.1.10 1
Default Gateway: 192.168.1.1
==========================
Persistent Routes:
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.10 20
10.1.0.0 255.255.255.0 172.20.10.62 172.20.10.62 1
10.2.0.0 255.255.255.0 172.20.10.62 172.20.10.62 1
65.216.9.229 255.255.255.255 192.168.1.1 192.168.1.10 1
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
172.20.10.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.10.62 255.255.255.255 127.0.0.1 127.0.0.1 20
172.20.11.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.21.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.31.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.50.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.51.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.60.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.61.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.70.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.71.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.81.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.91.0 255.255.255.0 172.20.10.62 172.20.10.62 1
172.20.255.255 255.255.255.255 172.20.10.62 172.20.10.62 20
192.168.1.0 255.255.255.0 192.168.1.10 192.168.1.10 20
192.168.1.1 255.255.255.255 192.168.1.10 192.168.1.10 1
192.168.1.10 255.255.255.255 127.0.0.1 127.0.0.1 20
192.168.1.255 255.255.255.255 192.168.1.10 192.168.1.10 20
224.0.0.0 240.0.0.0 172.20.10.62 172.20.10.62 20
224.0.0.0 240.0.0.0 192.168.1.10 192.168.1.10 20
255.255.255.255 255.255.255.255 172.20.10.62 172.20.10.62 1
255.255.255.255 255.255.255.255 192.168.1.10 192.168.1.10 1
Default Gateway: 192.168.1.1
Try this:
https://supportforums.cisco.com/thread/2084929
Workaround 2, changing metric of wired/wireless adapter not vpn client.
https://supportforums.cisco.com/thread/2084929
Workaround 2, changing metric of wired/wireless adapter not vpn client.
Featured Post
Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
Concerto Cloud Services, a provider of fully managed private, public and hybrid cloud solutions, announced today it was named to the 20 Coolest Cloud Infrastructure Vendors Of The 2017 Cloud (http://www.concertocloud.com/about/in-the-news/2017/02/0…
- Storage
- Concerto Cloud Services
- Cisco
- Analytics
- Cloud Computing
- Cloud Services, *CRM, *Virtual Private Cloud (VPC)
This article explains the fundamentals of industrial networking which ultimately is the backbone network which is providing communications for process devices like robots and other not so interesting stuff.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:
• Key questions to ask when considering a partnership to accelerate your business into the cloud
• Pitfalls and mistakes other partners…
Suggested Courses
Course of the Month10 days, 17 hours left to enroll
770 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.