PIX VPN help.

J1C · 2006-11-20T22:18:36+00:00

I have a simple site to site vpn - but one issue that I am not sure howto address...my network is on 192.168.10.xxx however the IP I need to come into theremote site on is 192.168.100.xxx - how do I adjust my routes toaccommodate this?thanks

Nov 20, 2006 27 Replies

Rate this thread:

J1C 19 years ago

LAN-------ROUTER-----PIX-----INTERNET/VPN------PIX----LAN

Thanks for sticking this out!! This connection would not be balanced.

- Only traffic that is balanced would have to NAT'd to a 10.98.74.0 IP would be load balanced.

ie. static (inside,outside) b.b.b.205 10.98.74.210 netmask

255.255.255.255 0 0

- There are other IPSEC tunnels working flawlessly. The only difference between them are that this one that is not working uses 192.168.70.0 - the rest use the 192.169.10.0 network.

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : IP Address. . . . . . . . . . . . : 192.168.10.30 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.10.1

Yes. pixfirewall# ping 192.168.10.30 192.168.10.30 response received -- 0ms 192.168.10.30 response received -- 0ms 192.168.10.30 response received -- 0ms

Vote

Brian V 19 years ago

LAN-------ROUTER-----PIX-----INTERNET/VPN------PIX----LAN

When you do a traceroute from the server 192.168.10.X to 10.10.1.1 does it follow the right path? I think your path should be:

192.168.10.1 (layer 3 switch?) 10.98.74.2 (your load balancer) 10.98.74.1 (inside of Pix)

Vote

J1C 19 years ago

LAN-------ROUTER-----PIX-----INTERNET/VPN------PIX----LAN

I get...

192.168.10.1 (load balancer)
216.x.x.x (IP of my ISP)
216.x.x.x (IP of my ISP)
204.x.x.x (IP of WorldCom/MCI) reports host unreachable

Vote

Brian V 19 years ago

LAN-------ROUTER-----PIX-----INTERNET/VPN------PIX----LAN

LAN------Router------Internet/VPN------Router-----LAN

The #2 IP...is that directly outside of the Pix? Does it end in .97?

Vote

J1C 19 years ago

LAN-------ROUTER-----PIX-----INTERNET/VPN------PIX----LAN

LAN------Router------Internet/VPN------Router-----LAN

No, it is .125.

Vote

Brian V 19 years ago

news: snipped-for-privacy@e3g2000cwe.googlegroups.com...

LAN-------ROUTER-----PIX-----INTERNET/VPN------PIX----LAN

LAN------Router------Internet/VPN------Router-----LAN

The default gateway of your Pix is x.x.x.97, unless that is an HSRP address you are not going out the Pix that you have the VPN setup on, you are taking an alternate path via the load balancer. That also explains why the other side is not seeing your traffic.

Vote

J1C 19 years ago

LAN-------ROUTER-----PIX-----INTERNET/VPN------PIX----LAN

LAN------Router------Internet/VPN------Router-----LAN

Thanks for the help Brian, I ended up grabbing a Cisco tech to help out. We upgraded the PIX to 6.3(5) and used a policy based NAT to route the interesting traffic.

Vote