?
Solved

Question on Static Routing vs. VPN Connections

Posted on 2013-06-12
4
Medium Priority
?
268 Views
Last Modified: 2014-03-03
Group, wanted to run a scenario by you and get your input. Here is our setup:

Site 1
Administrative LAN 172.16.8.1
Workstation VLAN 10.0.2.1

Site 2
LAN 192.168.10.0

I need to be able to connect the VLAN of site 1 to the LAN of site 2, currently we have an IPSec tunnel from LAN <--->LAN so the question is how to route the traffic. My question is this:

In Site 1 do I do a static route to force the traffic out?
Do I break the existing connection from LAN to LAN and do the Site 1 VLAN to Site 2 LAN VPN tunnel? Will it let me do a tunnel from a VLAN to a LAN?
Do I create a second tunnel from Site 2 to to both Site 1 LAN and VLAN?

Appreciate your time and input as always experts.
0
Comment
Question by:Ross Mccullough
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
4 Comments
 
LVL 18

Accepted Solution

by:
Sanga Collins earned 1000 total points
ID: 39244038
If you already have a tunnel established and site 1 LAN can communicate with site 2 LAN and vice versa. Then all you should need is a new route at site 2 stating that all traffic for VLAN 10.0.2.1 should go through the existing tunnel.
0
 
LVL 39

Expert Comment

by:Aaron Tomosky
ID: 39244088
Agreed, its just a route and probably a firewall rule. No need for another tunnel
0
 
LVL 25

Expert Comment

by:Cyclops3590
ID: 39244099
it depends on the type of firewall you have.

most firewalls and routers you setup a tunnel interface and then point routes at it like has already been mentioned.  In this case, just add another route pointing to the tunnel interface.  But make sure routing is setup on both sides so return traffic can get back.

however, i know that it doesn't quite work that way for the cisco PIX/ASA firewalls.  there you have to use the route that points you to the internet instead (usually the default route).  Then you have to create the ACL for nat 0 (nat exemption) and an ACL used to identify "interesting" traffic that is to go thru the tunnel.  In this case you just add the other subnets to the nat 0 ACL and the interesting traffic acl.  Then you kill the tunnel SA and let it form again by sending traffic that will be encapsulated in the tunnel.
0
 

Author Comment

by:Ross Mccullough
ID: 39244660
Group,
Thanks so much for your feedback. In our Site2 router (2911) I have added the follow inside the Static and Dynamic Routing but I cannot ping the VLAN gateway in Site 1 at 10.0.2.1 but can ping the LAN gateway via the VPN tunnel at 172.16.8.1. Thanks very much guys!

<Entry>
Prefix: 10.0.2.0
Prefix Mask 255.255.255.0
Forwarding (Next Hop) Interface
Forwarding Interface Gi0/0  (outside interface)
Metric 2
Permanent route <unchecked>
0

Featured Post

Portable, direct connect server access

The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Hello to you all, I hear of many people congratulate AWS (Amazon Web Services) on how easy it is to spin up and create new EC2 (Elastic Compute Cloud) instances, but then fail and struggle to connect to them using simple tools such as SSH (Secure…
Shadow IT is coming out of the shadows as more businesses are choosing cloud-based applications. It is now a multi-cloud world for most organizations. Simultaneously, most businesses have yet to consolidate with one cloud provider or define an offic…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses

765 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question