Access other subnets connected through IPSec tunnels from a VPN client

[JBZ]

Hello all, I' m somewhat finding difficult to understand why remote VPN clients are able to reach only some internal resources ... I have a site2site IPSec VPN connecting " Site A" to " Site B" . The computers from both sites are able to comunicate with each other. The remote IPSec VPN Clients connect to IPSec tunnel terminating in " Site A" and are able to comunicate to all internal computers inside this site but not the computers from " Site B" .

[pchechani_FTNT]

Hi JBZ It looks like you have policy for Remote VPN clients Interface to SITE A, but you may be missing firewall policy to interface connected with SITE B.

[JBZ]

Yes, it looks like there' s a problem either with firewall polycies or routing... But then I found this https://supportforums.cisco.com/thread/2130286 CISCO FORUM Should I try SSL VPN for remote clients intead of IPSec ???

[rwpatterson]

In order to do this, you need to create the tunnel on the IPSec terminating side (site A) in interface mode. The FGT cannot route from a remote subnet to another remote subnet using the older (legacy, or type " ENCRYPT" ) policy based IPSec setup. With the interface mode setup, you add a static route to the remote site (site B) so that the FGT knows how to route that traffic.

[JBZ]

rwpatterson

Hi rwpatterson. I allready have it running as IPSec interface mode but, here' s another question: Concerning the subinterfaces created when you choose IPSec Interface Mode. Should they have a " local" and " remote" IP configured???? Find bellow the configured static routes for the two sites. SITE A: Static route 1: 192.168.10.0/24 forced through IPSec tunnel reach internal computers from SITE B; Static route 2: 10.0.0.0/24 to reach remote dialup VPN clients; Static route 3: 0.0.0.0/32 to let internal computers access the internet; SITE B: Static route 1: 192.168.1.0/24 forced through IPSec tunnel reach internal computers from SITE A; Static route 2: 10.0.0.0/24 to reach remote dialup VPN clients; Static route 3: 0.0.0.0/32 to let internal computers access the internet; Thanks.

[rwpatterson]

Site B static route 2 should be poing down the IPSec interface mode tunnel. That should be all you need, along with the correct policies on both sides.

[divya]

Hi, I M hving the same issue , I am trying to make connection successful from VPN user on site A to Site B network and viceversa remote user -- VPN1 -> Site A -- VPN 2 -> Site B Site A -- VPN 2 <- Site B <- VPN 3 -- remote user remote user can successfully VPN into either site , but can' t to another site after VPN. even local n/w from site A to Site B can be accessible so VPN 2 is good to go , as well VPN 1 and 3 are good separately. I have added policy to allow my SSL network to tunnel interface on both site (A and B), also applied static route to allow SSL n/w on site A from tunnel interface on site B . can any one assist me to resolve my issue . I believe its all with policy and route , but can' t figure out

[JBZ]

Hi. I managed to fix it temporaraly by choosing " Use NAT" in the firewall policy that permits dial-up users to connect to Site A. The first time I connected I was able to reach clients inside both sites, all was working fine. In the following attempts to connect I get this error " aggressive mode message #2 (ERROR)" . I had to disable " Use NAT Travessal" in the vpn client, I can connect but I get no IP from DHCP server, thus no connectivity...