Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We currently have 2 VPNs set up between our LAN and 2 different clouds using 2 different Routers. Those VPNS are working well on their own but now I need to be able to ping from clients in one VPN to clients on the opposite VPN going through our network and even though I can ping from the routers themselves to the clients on the opposite VPN networks I can't seem to ping from client to client located on the opposite Clouds. I made a graphic to help you visualize the problem.

Again, from each router I can ping the clients on both clouds but from clients on each cloud I can not ping each other. What should I do? How do I solve this problem. I though adding routes in my cisco router would take care of it but it did not.

Any ideas? Thanks in advanced.

Here is a link to the graphic: Graphic Representation of Problem

Also if You are wondering why there are 2 routers, well it's because amazon VPNs need to be created with BGP and the sonicwall router does not do BGP so we had to buy the cisco router...

share|improve this question
Could this possibly be an issue with implicit access-lists not letting unknown networks pass through? – rii Apr 7 '11 at 20:08
up vote 0 down vote accepted

I received the following answer from sonicwall tech support, that said I still need some clarification. Seems like the config on the remote side of both VPNs needs to be modified and I don't really have access to those devices:

In this case since the VPNs are being held by different appliances a normal Hub and spoke option will not apply but the same principles willbe used, You need to make the VPNs aware of each other and allow a path for them to communicate.

From the Sonicwalls persective: The Ycloud remote Sonicwall (LAN of needs to be aware of the network as a Destination SO the Destination object for this tunnel would need to be a Group Object containing both the and the networks.

Likewise the Main Sonicwall (Lan of needs to be aware that the will be sending ti traffic that is going into the VPN, this is accomplished by changing the Source for the VPN tunnel to a group containing both the and network objects.

This adjustment is very much like a normal hub and spoke network, however as the second tunnel is on the Cisco router at the main site, a static route would be needed to push the traffic fromthe Sonicwall to the Cisco and back. Effectively stating Source: Any, Destination:, Source: Any(you can limit this as you wish) Gateway: Interface: (LAN interface of the Sonicwall most likely X0).

Likewise the Cisco will have to provide a path for the netowrk using VPN adjustments and routes, but that will be unique to the Ciscos configuration. Please update back if you need more information this for the Sonicwall, or if you are seeing drop messages from the Sonicwall indicating a block on this pass through.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.