Member Avatar for betaman

Hi,
I have one intranet - 254 and one 192.168.17.1-254
The first one is the main domain based on a domain -DHCP server (win2003) and it work inside our factory (main office)
The second one is our secondary offices wich logon to the same domain server of the main offices.

The two spots are connected together using two sisco ADSL routers using VPN connection (MPLS lines) the router in the main office has the ip # the second has .

The second net takes IPs from the router wich have the address
The first one get IPs from DHCP server.

Now I also have internet access using a 3com router so each computer that has a default gateway of wich is the IP of the 3com has internet access. BUT when I have the gateway turned to i cannot see the ....17.x subnet viseversa when i have the gateway turned to (cisco router) i cannot see internet PLUS the ......17.x subnet cannot see the main office internet gateway at all.

Is there a way to route or do something to avoid all these problems ?

  • 2 Contributors
  • 2 Replies
  • 129 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by betaman

Dani AI

Generated

Quick diagnosis: this is classic asymmetrical-routing. Machines that use the Internet box as their gateway send packets for the remote office to that Internet device, which has no route into the VPN. Machines that use the VPN router as gateway send Internet-bound packets into the VPN router, which isn’t forwarding/masquerading them to the Internet box. The fix is to make sure both the Internet device and the VPN routers know how to reach both LANs and that firewall/NAT rules allow the traffic.

Practical fixes (pick one that fits your policy):

  • Keep the Internet device as the default gateway for LAN clients and add a static route on it pointing to the VPN router for the remote-subnet(s). That gives the Internet device a next hop for return traffic destined to the remote office.
  • Or make the VPN router the LAN’s default gateway and add a default route on that router pointing to the Internet device (or enable NAT on the VPN router to the Internet device). This makes Internet-bound traffic traverse the VPN router to the Internet device.
  • As a last resort, if you cannot add static routes on the Internet box, configure the VPN router to NAT remote-office addresses into an address range the Internet device will accept.

Example commands (use your real subnets/next-hops):

# on a Cisco: add route to remote LAN via local VPN-router-IP
ip route <remote-subnet> <mask> <next-hop-ip>

# make VPN router forward Internet via Internet gateway
ip route 0.0.0.0 0.0.0.0 <internet-gateway-ip>

# Windows route (for testing)
route add -p <remote-subnet> mask <mask> <next-hop-ip>

Troubleshooting checklist:

  • Confirm VPN phase/policy includes both LAN networks.
  • From a client, run traceroute to a remote-host and to 8.8.8.8 to see where traffic drops.
  • On the Cisco run show ip route and show crypto ipsec sa; on a Windows host run route print.
  • Check firewall/NAT rules on the Internet device to allow traffic from the remote-subnet.

As ’s diagram helped show, start by adding a single static route on the Internet box back to the VPN router and verify VPN routing is advertising both subnets. That usually resolves the visibility problems without reconfiguring every client. Credit to for requesting the topology—keep that map updated while testing.

Recommended Answers

All 2 Replies

Member Avatar for mostafadotnet

could you give us the map of your network in an image, so that I can help you.

Try Visio or diagram drawing program.

Good luck.

Member Avatar for betaman

could you give us the map of your network in an image, so that I can help you.

Try Visio or diagram drawing program.

Good luck.

here is the attachment...I draw it as best as I could...

alunet.JPG 44.76 KB
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.