Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a user accessing a Sonicwall NSA 2400 via vpn (Site A). This Sonicwall has a VPN tunnel to another site (Site B). The user can ping servers at Site B, and access websites located on them, etc. People on the physical LAN at Site A can ping and telnet to the vpn user. However, the problem is that the servers located at Site B cannot contact the VPN user. They can contact any computer on the LAN, but no vpn users. I have done a packet capture, and anytime I ping the vpn user from the servers at Site B, the packet is "Consumed" on the firewall. I am pretty good with networking concepts, but this has me stumped.

share|improve this question

1 Answer 1

There are a number of possible reasons for this.

  1. Routing If the Sonicwall performs SNAT for any traffic going from Site A to Site B (possibly due to overlapping subnets), then traffic from the vpn user towards the servers at B will work and the reverse will also work, because the original address has been replaced by the SNAT with the address of the Sonicwall, which performs the reverse translation, too. However, if the servers on Site B do not know where to route the traffic for the VPN user, it will go out through the default gateway and therefore never reach the VPN user. Remember: VPN users often have IP addresses in a subnet very different from the subnet used on site A, so that the VPN router can route the packets to the individual clients.
  2. Firewall It is possible that your firewall has rules that allow NEW packets (as in state NEW) to go from site A to site B, but not the other way around. That would also explain your situation.
  3. VPN configuration More of a theoretical one. Some VPNs can be configured such that the VPN clients are not reachable from the target LAN. Since you say the people on site A can reach the VPN user, this seems not to be the problem.

I would suggest you post your firewall rules and your routing tables, and then we can inspect that and advise further.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.