Can't Connect to Anything Over Site-to-Site VPN

I have a site-to-site VPN with Amazon AWS. I see the tunnel is up, but I can't connect to anything on either side. Any idea where I should be looking on either side to ensure routes are configured correctly.

Thoughts?

Amazon Side:
Routes
2015-04-06-7-13-27.jpgInbound Firewall Rules
2015-04-06-7-13-46.jpgOutbound Firewall Rules
2015-04-06-7-13-57.jpgLAN to VPN
2015-04-06-7-24-58.jpgVPN to LAN
2015-04-06-7-35-49.jpg
Joshua DumasAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Zephyr ICTCloud ArchitectCommented:
Do you have routes propagated? Seems you don't have a route to your other network, only local.
0
Joshua DumasAuthor Commented:
I'm confused at what your question is and what your noticing.
0
Joshua DumasAuthor Commented:
2015-04-06-9-37-37.jpg
0
Introducing the "443 Security Simplified" Podcast

This new podcast puts you inside the minds of leading white-hat hackers and security researchers. Hosts Marc Laliberte and Corey Nachreiner turn complex security concepts into easily understood and actionable insights on the latest cyber security headlines and trends.

Zephyr ICTCloud ArchitectCommented:
In your very first screenshot, Routes ... There's only local Destination, there's no route to your other network, the one on the other side of the VPN
0
Joshua DumasAuthor Commented:
So I created the route, but I'm still not able to connect to anything on either end

2015-04-06-9-44-24.jpg
0
Zephyr ICTCloud ArchitectCommented:
Are you using static routing? Probably, just making sure...

What about Route Propagation, you might need to propagate the routes so your AWS network can reach your gateway on the other end...
0
Joshua DumasAuthor Commented:
Yes I am using static routes

Looks like on the AWS route prop is setup

2015-04-06-9-49-21.jpg
0
Zephyr ICTCloud ArchitectCommented:
Yes, but for the other gateway (remote site or client site) propagation needs to be "Yes" in the previous screenshot it's still "No".

So in Route Propagation you should add it...
0
Joshua DumasAuthor Commented:
Sorry I provided the wrong screen shot - it is propagate

2015-04-06-9-49-21.jpg
From Subnets on AWS:
2015-04-06-9-58-09.jpg
0
Joshua DumasAuthor Commented:
2015-04-06-9-56-58.jpg
0
Zephyr ICTCloud ArchitectCommented:
You should add the subnet (virtual private gateway) from your side/customer side to the Route Propagation, the 192.168.99.0/24 network specifically.

Can you show me the Route Tables ...
0
Joshua DumasAuthor Commented:
When I'm looking at the routing table on my local side I don't see a route to the Amazon AWS side (see screen shot below). Could that be a problem or THE problem?

2015-04-06-10-06-27.jpg
0
Joshua DumasAuthor Commented:
So sorry for the back and forth, but you've been nothing but so helpful !!!!

See on my side the routing policy in which I can add - what would the gateway and interface be???

2015-04-06-10-09-21.jpg
0
Joshua DumasAuthor Commented:
here are the gateway and interface choices I have

gateway
gateway.jpg
interface
interface.jpg
0
Zephyr ICTCloud ArchitectCommented:
In principle all traffic should go out the gateway, do it should find the way, you could easily test this with a trace route.
But you'll need a machine on both sides.

From your side, do a trace route (for Windows it's tracert) to a machine on the AWS side, from the AWS side do a trace route to a machine on your network and check where it fails.
0
Zephyr ICTCloud ArchitectCommented:
Ok, no problem ...
For the Routing Policies I'd choose no Gateway and for interface you'll need to have the IPsec Primary Gateway (I'm not sure if you have it in the list) ... If you have just the one tunnel. If you have two tunnels you need to create this connection two times, one for the first tunnel and a second one for the second.
0
Joshua DumasAuthor Commented:
Looks good, I can route over to Amazon AWS, but it times out over there - wonder if theres a routing issue on AWS side

2015-04-06-10-33-43.jpg
2015-04-06-10-35-27.jpg
0
Zephyr ICTCloud ArchitectCommented:
It's probably because your network is not propagated yet on Amazon's side ... As per my previous comment :)

You should add the subnet (virtual private gateway) from your side/customer side to the Route Propagation, the 192.168.99.0/24 network specifically.

Can you show me the Route Tables ...
0
Joshua DumasAuthor Commented:
2015-04-06-10-45-57.jpg
0
Zephyr ICTCloud ArchitectCommented:
ok, propagated, but you do not really need that second (propagated) local network there, the last one in the list you can remove that.

What does the trace route tell you when starting from the AWS side?
0
Joshua DumasAuthor Commented:
I don't have the option to remove it

2015-04-06-10-49-28.jpg
0
Zephyr ICTCloud ArchitectCommented:
Weird, what does Subnet Associations tell us... Might be you attached your local net to a VPG where it wasn't needed...
0
Joshua DumasAuthor Commented:
2015-04-06-10-57-56.jpg
0
Zephyr ICTCloud ArchitectCommented:
Hmmm, we should find a way to remove the 192.168.200.0/24 network from the Route Propagation, not sure where it's configured that it won't let you delete it maybe at the Virtual Private Gateway level ...
0
Joshua DumasAuthor Commented:
I think its coming from the Virtual Private Gateway - see below

2015-04-06-11-16-15.jpg
2015-04-06-11-17-24.jpg
0
Zephyr ICTCloud ArchitectCommented:
Hmmm no ... Strange, you have two addresses connected to the same vgw-target ... That causes some routing issues probably...

I'll have to go over my config to see where it's going wrong, but I have to go now I'm afraid, I might be able to help you again tomorrow.
0
Zephyr ICTCloud ArchitectCommented:
So, how far are we on this? Any progress?
0
Joshua DumasAuthor Commented:
Heres where we are at.....

I rebuilt the VPC after we talked and I'm able to tracert to a device on the Amazon side, but it stops right after it gets over to them - see below

2015-04-07-7-04-48.jpg
I'm able to connect to a device on the Amazon side (I have a public IP that I'm able to RDP to) and I tracert to something on my side, but that fails completely - see below

2015-04-07-7-06-24.jpg
As for the VPC, I took the time to take screen shots of everything



2015-04-07-7-07-36.jpg2015-04-07-7-08-04.jpg2015-04-07-7-08-16.jpg2015-04-07-7-11-22.jpg2015-04-07-7-11-33.jpg2015-04-07-7-11-48.jpg2015-04-07-7-11-58.jpg2015-04-07-7-12-14.jpg
0
Zephyr ICTCloud ArchitectCommented:
Good thing starting from scratch... But it's still the same issue, you need to add the route back to your network and propagate it to the VPC network. This way that (VPC) network will know the way to your network.

Let me see if I can find some instructions on that if need be.
0
Zephyr ICTCloud ArchitectCommented:
It's actually in the AWS manual so it seems:

For static routing, if you do not enable route propagation, you must manually enter the static routes used by your VPN connection. To do this, select your route table, then on the Routes tab in the details pane, click Edit. Add the static route used by your VPN connection in the Destination field, select the virtual private gateway ID from the Target list, and then click Save.

Source
0
Joshua DumasAuthor Commented:
Recreating the VPN connection did the trick....Can't believe it was that easy.....Thanks so much for your assistance! !!!!
0
Zephyr ICTCloud ArchitectCommented:
No problem ... Glad I was helpful :)
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
AWS

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.