[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 136
  • Last Modified:

AT&T Managed VPN works one way

We have an AT&T managed VPN between 2 office locations.  Location A uses 192.168.1.0.  Location B uses 192.168.2.0.  All of the sudden, traffic cannot travel from A to B, but CAN travel from B to A.  We can resolve names from A to B, but any attempts to ping or tracert items in B stop at the B gateway (192.168.2.1).  Any ideas?
0
BullfrogSoftware
Asked:
BullfrogSoftware
  • 10
  • 5
  • 5
1 Solution
 
vipeliteCommented:
What type of devices in question?
0
 
BullfrogSoftwareAuthor Commented:
the endpoints are AT&T provided cisco routers.  The network is an SBS managed (DNS, Active Directory) Windows network.
0
 
rharland2009Commented:
Is the 192.168.2.1 address @ the B side the LAN interface of the ATT router?
0
 The Evil-ution of Network Security Threats

What are the hacks that forever changed the security industry? To answer that question, we created an exciting new eBook that takes you on a trip through hacking history. It explores the top hacks from the 80s to 2010s, why they mattered, and how the security industry responded.

 
BullfrogSoftwareAuthor Commented:
Yes:

A (192.168.1.0) -> Gateway 192.168.1.1 -- VPN -- Gateway 192.168.2.1 -> B (192.168.2.0)

B can ping or map devices all the way through to A (i.e. printer at 192.168.1.151)
A cannot ping or map devices all the way through to B (pings, tracerts stop at gateway (192.168.2.1))
0
 
rharland2009Commented:
Do you have CLI access to these routers? Most ATT managed offerings don't include that, but on the router is a logical place to start troubleshooting.
0
 
BullfrogSoftwareAuthor Commented:
Here is the main problem.  No access to the router interface.  Ticket submitted to ATT resulted in 'Our interfaces are all up, sorry'
0
 
rharland2009Commented:
Okay. Are the LANs at the two locations just flat /24s? In other words, is the LAN interface of the ATT router in the same subnet as all devices at each location?
0
 
BullfrogSoftwareAuthor Commented:
Yes, for an example:

Location A
Gateway (192.168.1.1)
Computer (192.168.1.2)
Printer (1982.168.1.3)

Location B
Gateway (192.168.2.1)
Computer (192.168.2.2)
Printer (1982.168.2.3)
0
 
rharland2009Commented:
Ok, great. Do you have visibility into the LAN at each location? That is, is there a managed switch you can access?

I'm guessing depending on your location, it might be tough to see B's LAN at this point.
0
 
vipeliteCommented:
Is the VPN on the At&t Managed router?
0
 
BullfrogSoftwareAuthor Commented:
Yes. The VPN is att managed.
0
 
vipeliteCommented:
Power off/on
0
 
BullfrogSoftwareAuthor Commented:
We have visibility.  I have remotes to units on both sides.
0
 
vipeliteCommented:
Provide: show ip route on B side where the gateway is failing.
0
 
BullfrogSoftwareAuthor Commented:
Route tables:

Side A
-------------

IPv4 Route Table
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x10003 ...00 13 72 5f cd 9d ...... Broadcom BCM5708C NetXtreme II GigE (NDIS VBD Client)
===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1      192.168.1.7      1
      25.29.221.0    255.255.255.0      192.168.1.5      192.168.1.7      1
        127.0.0.0        255.0.0.0        127.0.0.1        127.0.0.1      1
      192.168.1.0    255.255.255.0      192.168.1.7      192.168.1.7     20
      192.168.1.7  255.255.255.255        127.0.0.1        127.0.0.1     20
    192.168.1.255  255.255.255.255      192.168.1.7      192.168.1.7     20
        224.0.0.0        240.0.0.0      192.168.1.7      192.168.1.7     20
  255.255.255.255  255.255.255.255      192.168.1.7      192.168.1.7      1
Default Gateway:       192.168.1.1
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
      25.29.221.0    255.255.255.0      192.168.1.5       1

Side B
---------

Interface List
 11...f8 bc 12 8e 9a 66 ......Realtek PCIe GBE Family Controller
  1...........................Software Loopback Interface 1
 12...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
 13...00 00 00 00 00 00 00 e0 Microsoft 6to4 Adapter
 14...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.2.1    192.168.2.123    276
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.2.0    255.255.255.0         On-link     192.168.2.123    276
    192.168.2.123  255.255.255.255         On-link     192.168.2.123    276
    192.168.2.255  255.255.255.255         On-link     192.168.2.123    276
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     192.168.2.123    276
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     192.168.2.123    276
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
          0.0.0.0          0.0.0.0      192.168.2.1  Default
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  1    306 ::1/128                  On-link
 11    276 fe80::/64                On-link
 11    276 fe80::28b9:9b3f:6e31:4254/128
                                    On-link
  1    306 ff00::/8                 On-link
 11    276 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None
0
 
vipeliteCommented:
These are actual PCs route prints. One thing I see A vs B is persistent route that has been added on A side. Also, IPv6 is enabled on B side, you might as well turn that off could cause unwanted issues. Find out what that persistent route is for. You may need to add it on B side possibly VPN?
0
 
BullfrogSoftwareAuthor Commented:
The persistent route was an old server, and has been removed.  No effect on the problem.  I will also add that we power cycled the devices at both endpoints.
0
 
rharland2009Commented:
Going back a little, when you say you can resolve names from A to B - does the name resolution occur at site A or site B?
What does a tracert from site B to site A look like? What does a tracert from site A to site B look like? Can you show us?
0
 
BullfrogSoftwareAuthor Commented:
It is going to be one of those issues that is never really answered.  Reboots of the ATT endpoints resolved the issue.
0
 
BullfrogSoftwareAuthor Commented:
Sometimes simple is best.
0

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

  • 10
  • 5
  • 5
Tackle projects and never again get stuck behind a technical roadblock.
Join Now