Hi all.
I have a hub/spoke config connected via dialup hub route based ipsec vpn. The spokes can communicate with the hub, and the hub can communicate with the spokes, but spoke to spoke cannot communicate. Here I think is all the necessary config. (I have two clients who have this setup, this one with only 2 branches, and another one with 8 branches. Both display the same thing, so it must be something in my configuration that is not right). Sorry if it is too much info, but just in case anyone looks on this forum for how to set it up, they can (albeit if they do my config it won' t work all the way)
Admin:
-wan 1 ip: 70.12.232.154
-lan ip: 192.168.254.1 (Class C)
-phase1:
--name:toSpokes
--DialupUser
--wan 1/ Main/ Preshared Key
--accept any peer ID
--Enable IPSec Interface
--IKE 1 / Main
--3DES/SHA1
--DHGroup 5
--keylife 28800
--XAUTH off
--NAT T enabled
--DPD enabled
-phase2:
--name: toSpokesPh2
--selected toSpokes
--3DES/SHA1
--enable replay detection
--enable PFS
--DH Group 5
--keylife 1800 seconds
--autokeepalive off
--dhcp ipsec off
--no quick mode selector (0.0.0.0/0)
-zone:
--places toSpokes into zone called Spoke_Zone. Unchecked " Block intra-zone traffic"
-addresses:
--Main_Lan: 192.168.254.0/24
--Branch1_Lan: 10.1.1.0/24
--Branch2_Lan: 10.1.2.0/24
---Group: Spokes_Net (Branch1_Lan and Branch2_Lan)
-firewall policy:
--Spoke_Zone/Spokes_Net --> internal/Main_Lan always/any/accept No NAT
-route:
0.0.0.0/0 wan1 70.12.232.153 distance 10
10.1.1.0/24 toSpokes distance 5
10.1.2.0/24 to Spokes distance 5
Spokes
-Branch1 (Branch 2 is identical except for wan, and branch 1 and branch 2 and associated addresses are swapped)
--wan ip 80.7.9.154
--lan ip 10.1.1.1 (Class C)
-vpn phase 1:
--Name: toHub
--Static: 70.12.232.154
--wan 1/ main/ preshared key
--accept any peer ID
--Enable IPSec Interface
--IKE 1 / Main
--3DES/SHA1
--DHGroup 5
--keylife 28800
--XAUTH off
--NAT T enabled
--DPD enabled
--vpn phase 2:
--toHubPh2
--selected toHub
--3DES/SHA1
--enable replay detection
--enable PFS
--DH Group 5
--keylife 1800 seconds
--autokeepalive on
--quick mode selector
---src: 10.1.1.0/24 / dst: 192.168.254.0/24
-addresses:
--Main_Lan: 192.168.254.0/24
--Branch1_Lan: 10.1.1.0/24
--Branch2_Lan: 10.1.2.0/24
-- Company_Net (Main_Lan and Branch2_Lan)
-firewall policy
--toHub/Company_Net --> internal/Branch1_Lan always/any/accept No NAT
--Internal/Branch1_Lan--> toHub/Company_Net always/any/accept No NAT
-route:
0.0.0.0/0 wan1 70.12.232.153 distance 10
10.1.2.0/24 toSpokes distance 5
192.168.254.0/24 to Spokes distance 5
Thanks everyone