VPN failure between two remote offices

Question

I have three offices all with broadband routers feeding into Server 2003 running Routing and Remote Access that provides the clients with internet access.

I have setup VPN connection between site1 and Site2 and between site1 and site3, however I want to setup a VPN connection between site2 and site3 but this is giving me problems.

Server at site1 can ping the router and server at site2 and site3 no problems, but site2 and site3 can not ping each other or each others router.

Any one have any idea why these two servers can't communicate with each other?

Edit:

I have been trying tracert to see if that gives me any clue where the problem is. To save giving out my IP address on a public forum I will use the following notation.

Server1 - server at site1, router1 router at site1 etc

router1 has ip of a.b.c.89
router2 has ip of d.e.f.217
router3 has ip of d.e.f.249

server1 a.b.c.90
server2 d.e.f.218
server3 d.e.f.250

so tracert of d.e.f.217 or 249 from server1 completes no problem as stated before.

tracert d.e.f.217 from server3 gives Destination host unreachable d.e.f.249 and tracrt d.e.f.249 from server2 gets as far as hop 2 before timing out.

Could it be anything to do with the similarity between site2 and site3's IP both having identical first three numbers?

Answer 1

You may not have this luxury, but I'm curious - if you disconnect site1 from site2, can you then connect site3 to site2?

My theory is that the external IP from 3->2 is being suppressed, due to the VPN wanting those sites to route internally.

Answer 2

Are all sites connected to the internet with the same ISP and broadband modem?

Are there firewalls in front of your W2K3 machines? If so (and there should be!) make sure NAT and Access Rules are configured properly.

You should make sure you have static IP set for all sites. You should check Windows Firewall settings for all computers. Check all logs on all routers and computers involved. [Edit] This article has a good one-two approach: http://blogs.technet.com/rrasblog/archive/2005/12/22/416421.aspx

Answer 3

I have never done this with Windows VPN to connect sites, but using router to router VPN I needed to setup a new route using the route command so that computers knew where to find each other on the otherside of the VPN

Example: VPN1 - 192.168.0.0 VPN2 - 192.168.1.0 VPN3 - 192.168.2.0

I have to tell basicly any computer on VPN1 that wanted to get to VPN2, that for the IP range of 192.168.1.0 they needed to go though router gateway 192.168.0.1 to get to 192.168.0.0

Don't know if this is the case in your situation, and I'm not a expert in this at all. Try googling route and it may explain it better.