Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Question on Static Routing vs. VPN Connections

Posted on 2013-06-12
4
Medium Priority
?
269 Views
Last Modified: 2014-03-03
Group, wanted to run a scenario by you and get your input. Here is our setup:

Site 1
Administrative LAN 172.16.8.1
Workstation VLAN 10.0.2.1

Site 2
LAN 192.168.10.0

I need to be able to connect the VLAN of site 1 to the LAN of site 2, currently we have an IPSec tunnel from LAN <--->LAN so the question is how to route the traffic. My question is this:

In Site 1 do I do a static route to force the traffic out?
Do I break the existing connection from LAN to LAN and do the Site 1 VLAN to Site 2 LAN VPN tunnel? Will it let me do a tunnel from a VLAN to a LAN?
Do I create a second tunnel from Site 2 to to both Site 1 LAN and VLAN?

Appreciate your time and input as always experts.
0
Comment
Question by:Ross Mccullough
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
4 Comments
 
LVL 18

Accepted Solution

by:
Sanga Collins earned 1000 total points
ID: 39244038
If you already have a tunnel established and site 1 LAN can communicate with site 2 LAN and vice versa. Then all you should need is a new route at site 2 stating that all traffic for VLAN 10.0.2.1 should go through the existing tunnel.
0
 
LVL 39

Expert Comment

by:Aaron Tomosky
ID: 39244088
Agreed, its just a route and probably a firewall rule. No need for another tunnel
0
 
LVL 25

Expert Comment

by:Cyclops3590
ID: 39244099
it depends on the type of firewall you have.

most firewalls and routers you setup a tunnel interface and then point routes at it like has already been mentioned.  In this case, just add another route pointing to the tunnel interface.  But make sure routing is setup on both sides so return traffic can get back.

however, i know that it doesn't quite work that way for the cisco PIX/ASA firewalls.  there you have to use the route that points you to the internet instead (usually the default route).  Then you have to create the ACL for nat 0 (nat exemption) and an ACL used to identify "interesting" traffic that is to go thru the tunnel.  In this case you just add the other subnets to the nat 0 ACL and the interesting traffic acl.  Then you kill the tunnel SA and let it form again by sending traffic that will be encapsulated in the tunnel.
0
 

Author Comment

by:Ross Mccullough
ID: 39244660
Group,
Thanks so much for your feedback. In our Site2 router (2911) I have added the follow inside the Static and Dynamic Routing but I cannot ping the VLAN gateway in Site 1 at 10.0.2.1 but can ping the LAN gateway via the VPN tunnel at 172.16.8.1. Thanks very much guys!

<Entry>
Prefix: 10.0.2.0
Prefix Mask 255.255.255.0
Forwarding (Next Hop) Interface
Forwarding Interface Gi0/0  (outside interface)
Metric 2
Permanent route <unchecked>
0

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Envision that you are chipping away at another e-business site with a team of pundit developers and designers. Everything seems, by all accounts, to be going easily.
In this article, we’ll look at how to deploy ProxySQL.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question