Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We currently have 2 VPNs set up between our LAN and 2 different clouds using 2 different Routers. Those VPNS are working well on their own but now I need to be able to ping from clients in one VPN to clients on the opposite VPN going through our network and even though I can ping from the routers themselves to the clients on the opposite VPN networks I can't seem to ping from client to client located on the opposite Clouds. I made a graphic to help you visualize the problem.

Again, from each router I can ping the clients on both clouds but from clients on each cloud I can not ping each other. What should I do? How do I solve this problem. I though adding routes in my cisco router would take care of it but it did not.

Any ideas? Thanks in advanced.

Here is a link to the graphic: Graphic Representation of Problem

Also if You are wondering why there are 2 routers, well it's because amazon VPNs need to be created with BGP and the sonicwall router does not do BGP so we had to buy the cisco router...

share|improve this question
    
Could this possibly be an issue with implicit access-lists not letting unknown networks pass through? –  rii Apr 7 '11 at 20:08

1 Answer 1

up vote 0 down vote accepted

I received the following answer from sonicwall tech support, that said I still need some clarification. Seems like the config on the remote side of both VPNs needs to be modified and I don't really have access to those devices:

In this case since the VPNs are being held by different appliances a normal Hub and spoke option will not apply but the same principles willbe used, You need to make the VPNs aware of each other and allow a path for them to communicate.

From the Sonicwalls persective: The Ycloud remote Sonicwall (LAN of 10.122.40.0) needs to be aware of the 172.16.50.0 network as a Destination SO the Destination object for this tunnel would need to be a Group Object containing both the 192.168.23.0 and the 172.16.50.0 networks.

Likewise the Main Sonicwall (Lan of 192.168.23.0) needs to be aware that the 172.16.50.0 will be sending ti traffic that is going into the VPN, this is accomplished by changing the Source for the VPN tunnel to a group containing both the 192.168.23.0 and 172.16.50.0 network objects.

This adjustment is very much like a normal hub and spoke network, however as the second tunnel is on the Cisco router at the main site, a static route would be needed to push the traffic fromthe Sonicwall to the Cisco and back. Effectively stating Source: Any, Destination: 172.16.50.0/24, Source: Any(you can limit this as you wish) Gateway: 192.168.23.15 Interface: (LAN interface of the Sonicwall most likely X0).

Likewise the Cisco will have to provide a path for the 10.122.40.0 netowrk using VPN adjustments and routes, but that will be unique to the Ciscos configuration. Please update back if you need more information this for the Sonicwall, or if you are seeing drop messages from the Sonicwall indicating a block on this pass through.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.