We help IT Professionals succeed at work.

Bizarre IP Address / Port Blocking Windows 7

391 Views
Last Modified: 2017-03-27
I have an environment with two physically separated networks both with Cisco RV130W routers. Here are the details...
  • There is a VPN Site-to-Site Tunnel established between the two sites.
  • From workstation on Site P I can ping server on Site L (happens to be IP 192.168.12.31) but cannot communicate over ports like 80, 443 etc.
  • When I test with telnet it times out.
  • When I monitor traffic on the VPN Tunnel no packets get transmitted when using ports.
  • There is TX and RX across the tunnel when pinging.
  • A workstation on Site L can access server on Site L so I know the server is working.
  • To make it more strange if I reset the VPN tunnel the communication works for a few minutes but then stops.

All of this tells me there is a firewall blocking 192.168.12.31 at the workstation but I have turned off Windows Firewall and WebRoot Firewall and there is no other firewall that I see on the workstation. I have also run Malwarebytes scanner and found nothing.

Any suggestions appreciated. Thank you kindly
Comment
Watch Question

Business Consultant (Owner)
Most Valuable Expert 2012
Expert of the Year 2018
Commented:
Unlock this solution and get a sample of our free trial.
(No credit card required)
UNLOCK SOLUTION
Robert WagstaffIT Consultant

Author

Commented:
Thank you for your response. Site P has network id of 192.168.1.0 and Site L has network id of 192.168.12.0. The tunnel seems to be working fine as I can ping the server at Site L and even access a second server's web page at Site L from the workstation at Site P. It truly is the strangest thing I have ever seen. I am trying to get a second workstation there to see if the issue is specific to the one workstation however the sites are 3 hours drive from where I am so trying to avoid that.
JohnBusiness Consultant (Owner)
Most Valuable Expert 2012
Expert of the Year 2018

Commented:
Where is the Cisco - 3 hours away?  

Did you enable Remote Management (Port 443)?  Can you log into it and check settings?

If it is remote and you cannot manage it, you are going to need a trusted person at the other end to set up remote management.
Robert WagstaffIT Consultant

Author

Commented:
Yes, both Cisco RV130W are 3 hours away. I have remote access to both of them and can even look at packets going across the tunnel as statistics. When I telnet to second server port 80 it connects and I see TX and RX traffic. When I telnet to the main server port 80 there is 0 TX or RX. It's like it never gets to the tunnel. Again, bizarre behavior.
JohnBusiness Consultant (Owner)
Most Valuable Expert 2012
Expert of the Year 2018

Commented:
So then try the tunnel settings (Keep Alive and NAT Traversal [both settings] as suggested.

Make sure Phase 1 and Phase 2 are correctly setup.
Robert WagstaffIT Consultant

Author

Commented:
I don't see a "keep alive" option but I did ENABLE NAT Traversal on both routers and now communication is working!!! =) I've been here before though so I need to monitor it over the next few days to see if it is stable. Hopefully this is all that was needed.

Thank you so much!!!! Not really sure what NAT Traversal does but if it works that's all that matters.
Qlemo"Batchelor", Developer and EE Topic Advisor
CERTIFIED EXPERT
Top Expert 2015

Commented:
NAT-T is used if at least one VPN device is behind another router performing IP translation. If the Ciscos are the Internet gateways, it cannot make a difference.
Robert WagstaffIT Consultant

Author

Commented:
All is going well. It has been almost 6 hours and it is stable.

Thank you
JohnBusiness Consultant (Owner)
Most Valuable Expert 2012
Expert of the Year 2018

Commented:
Sounds like good news, so please come back and close the question.
Qlemo"Batchelor", Developer and EE Topic Advisor
CERTIFIED EXPERT
Top Expert 2015

Commented:
Since I have doubts about NAT-T being a solution, please wait for a reasonable period to close the question.
JohnBusiness Consultant (Owner)
Most Valuable Expert 2012
Expert of the Year 2018

Commented:
Normally NAT-T works or does not, but the Tunnel itself has to reset when you change the variable, and resetting the tunnel may also have contributed to the stability.
Robert WagstaffIT Consultant

Author

Commented:
Thank you for all your help
JohnBusiness Consultant (Owner)
Most Valuable Expert 2012
Expert of the Year 2018

Commented:
You are very welcome.  I am glad it is working, and I think resetting the Tunnel (changing the variable) may have had an impact.
Unlock the solution to this question.
Thanks for using Experts Exchange.

Please provide your email to receive a sample view!

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.