IPSEC Router-to-Router Tunnel established - now what?
- From: "Mark C. Walton" <mcw@xxxxxxxxxxxxxxxxxx>
- Date: Mon, 8 Aug 2005 15:35:18 -0400
I thought I was starting to get a pretty good handle on routing, I'm not too
sure now. But I'm not sure if this is really an ISA issue or a routing
issue.
I have a number of remote sites which need access here to the corporate
network (and us to them). I have ISA installed on Win2K along with RRAS.
The way I have done this in the past is by installing a Win2K box at the
remote site and using RRAS to establish a PPTP tunnel back to the ISA box
(the remote site Win2K Server also has 2 NICs, internal private IP and
external public IP into the router). Then I use static routes in RRAS on
both ends to establish two-way communication. The static routes are bound
to the respective remote site interfaces in RRAS.
Now I want to try and eliminate the Win2K box at the other side and just use
a VPN router - most of the sites have only a few users and a Win2K setup
seems overkill. From what I have been able to discern, ISA won't pass IPSEC
to the internal interface without a lot of trouble (and maybe not even
then). So what I am trying to do is setup router-to-router VPNs - the
remote router being a simple Linksys and my local router right now being a
Seimens 5940 (connected to a T1). I can establish the tunnel just fine, but
I cannot get the two internal networks to see each other no matter how I try
to set up the routing. The Seimens has public IP address of, say,
100.100.100.1 and is connected to the external interface of the ISA box at
100.100.100.2 with GW 100.100.100.1. The internal ISA interface has private
IP of 10.10.10.1 with no gateway. The remote site has public IP
200.200.200.200 GW 200.200.200.1 and internal 10.20.20.20. On the Seimens
router IPSEC configuration I am setting the Remote Destination Subnet of
10.20.20.20 and Remote Gateway of 200.200.200.200. The remote router is set
for Remote IP Address of 100.100.100.1 (since there is no local private IP
subnet on the Seimens) and the Remote Gateway is the same (100.100.100.1)
As I said, I can establish the tunnel just fine and can ping the external
ISA interface from the remote router. I think maybe I just keep getting the
routing wrong, but it seems like I've tried everything that makes any sense.
I would greatly appreciate any help here.
Thanks,
- Mark
.
- Prev by Date: RE: how to deny client "sign in" Yahoo Messenger effectively?
- Next by Date: Re: VPN Problems after subnet change
- Previous by thread: Extensions tab in HTTP filtering options - allow default doc somehow?
- Next by thread: Re: IPSEC Router-to-Router Tunnel established - now what?
- Index(es):
Relevant Pages
|
