Internet traffic through VPN to
Bookmark this page:
 Yahoo!
 Google
 Windows Live
 del.icio.us
 digg
 Netscape
|
|
|||||||||||||||||||||||||
|
Posted by deca2499 on June 18, 2008, 7:10 am
Please log in for more thread options > deca2499 wrote:
> >>>> deca2499 wrote:
27
> >>>>> I am trying to figure out a problem we are having at the company I > >>>>> work at. Let me give you a bit of an overview. > >>>>> HQ in Mason, Ohio with a VPN3005, Outside IP of 172.16.180.90/30 > >>>>> (Changed the first octet for security). Inside IP of 172.16.180.96/= > >>>>> Branch in Pasadena, California with a PIX 506E, outside IP of
et
> >>>>> 132.15.161.122. Inside IP 172.16.180.129/26. > >>>>> The problem I am having is that HQ has a proxy that monitors Intern= > >>>>> traffic and websites. Branch office is not getting Internet traffic
s.
> >>>>> through the proxy. They can get to unauthorized and blocked website= > >>>>> I am thinking it may be some kind of routing issue, but am not sure=
at
> >>>>> this point. I have been looking at the newsgroups and am finding th=
at,
> >>>>> if I am understanding correctly, the PIX will not send packets back
p
> >>>>> out the same interface in which they arrived. > >>>>> I am rather new at working with PIXs and Cisco routers, so my > >>>>> understanding is not that great on this issue. Basically I need hel= > >>>>> on figuring out how to get the ALL traffic to come across the VPN t=
o
> >>>>> run through our proxy at the HQ. If you need more info, please let =
me
> >>>>> know.
to
> >>>>> Thank you in advance for all your help. > >>>> It might be something simple as split tunnel. Check ACL used in cryp= > >>>> map on PIX. If it allows only internal IP ranges, rest of the traffi=
c
> >>>> from branch office will be sent to internet directly.
> >>>> Regards, > >>>> Andrey.- Hide quoted text - > >>>> - Show quoted text - > >>> Here is everything that I can find with regards to crypto map on the > >>> PIX: > >>> crypto map vpn2 10 ipsec-isakmp > >>> crypto map vpn2 10 match address 101 > >>> crypto map vpn2 10 set peer VPNConcentrator > >>> crypto map vpn2 10 set transform-set vpn2 > >>> crypto map vpn2 interface outside- Hide quoted text - > >>> - Show quoted text - > >> I was looking at the 506E setup and see all the ACL ip permits: > >> access-list 101 permit ip 172.16.180.128 255.255.255.192 172.16.180.0 > >> 255.255.255.192 > >> access-list 101 permit ip 172.16.180.128 255.255.255.192 172.16.137.0 > >> 255.255.255.0 > >> access-list 101 permit ip 172.16.180.128 255.255.255.192 172.16.138.0 > >> 255.255.255.0 > >> access-list 101 permit ip 172.16.180.128 255.255.255.192 172.16.187.0 > >> 255.255.255.0 > >> access-list 101 permit ip 172.16.180.128 255.255.255.192 172.16.186.0 > >> 255.255.255.0 > >> access-list 101 permit ip 172.16.180.128 255.255.255.192 172.16.182.0 > >> 255.255.255.0 > >> access-list 101 permit ip 172.16.180.128 255.255.255.192 172.16.211.0 > >> 255.255.255.0 > >> access-list 101 permit ip 172.16.180.128 255.255.255.192 128.170.205.0 > >> 255.255.255.0 > >> access-list 101 permit ip 172.16.180.128 255.255.255.192 128.170.65.0 > >> 255.255.255.0 > >> access-list 101 permit ip 172.16.180.128 255.255.255.192 128.170.64.0 > >> 255.255.255.0 > >> access-list 101 permit ip 172.16.180.128 255.255.255.192 172.16.180.96 > >> 255.255.255.240 > >> access-list 101 permit ip 172.16.180.128 255.255.255.192 172.16.180.68 > >> 255.255.255.252 > >> access-list 101 permit ip 172.16.180.128 255.255.255.192 172.16.180.64 > >> 255.255.255.252 >
> >> Here is what I am not sure of, these three lines are for ATT.
> >> All the lines above it are for closet switches, and the last three > >> lines are for the VPN concentrator, 2811 router, and 4507 switch that > >> is behind the 2811 router. >
> >> My question would be should there only be a link to ATT, and to the
-
> >> VPN concentrator? I would think that the concentrator would forward > >> all packets from the VPN to the 2811 router. Am I correct in this > >> thinking? > >> The branch switch IP is the 172.16.180.128. > >> The internal interface on the 506 is 172.16.180.129.- Hide quoted text= >
> >> - Show quoted text -
> > Oooppss.. These three lines for ATT...
> > access-list 101 permit ip 172.16.180.128 255.255.255.192 128.170.205.0 > > 255.255.255.0 > > access-list 101 permit ip 172.16.180.128 255.255.255.192 128.170.65.0 > > 255.255.255.0 > > access-list 101 permit ip 172.16.180.128 255.255.255.192 128.170.64.0 > > 255.255.255.0 >
> Assuming you posted complete ACL 101, VPN tunnel between 506E and > concentrator is indeed split one. Only traffic between branch and HQ is > being sent over the tunnel. Traffic to Internet is being sent directly. > > Regards, > Andrey.- Hide quoted text - > > - Show quoted text - That is what I was thinking but wanted confirmation. Now comes the fun part, which part do we need to take out to force it across the tunnel? If we take out the ACL going to the 128.170.x.x, would that cut off all Internet access including the tunnel? My thinking would be that the only ACL that would need to be there would be the one to the router at HQ right? Or would it need to be going to the concentrator and drop the ACL to the router? Thank you. Scott | |||||||||||||||||||||||||
