Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have the following topology:

LAN A                LAN B                                           LAN C
10.14.0.0/16 <-VPN-> 10.18.0.0/16 --- SONICWALL <-VPN-> M0N0WALL --- 10.32.0.0/16

Traffic between LAN A and LAN B works perfectly. Traffic between LAN C and LAN B works perfectly. Traffic between LAN A and LAN C, not so much.

LAN A's gateway has a route to LAN C that points to the Sonicwall. The Sonicwall has a route to LAN A pointing to the VPN gateway connecting LAN B to LAN A. Tracing packets on the Sonicwall shows the LAN C destined traffic to arrive on the Sonicwall, but it does not forward the traffic, it dies there. Traffic from LAN B gets forwarded.

Tracing packets on the Sonicwall while sending traffic from LAN C destined for LAN A shows nothing.

This tells me that the M0N0WALL is not forwarding traffic for the 10.14.0.0 network and the Sonicwall is not forwarding from 10.14.0.0.

The SA on the Sonicwall terminates on the WAN ZONE and is defined to use an address group that incorporates both the 10.14.0.0 and 10.18.0.0 networks.

The M0N0WALL is configured for the 10.18.0.0 network and I have tried with both a static route to 10.14.0.0 and without on the M0N0WALL.

I tried manually adding the 10.14.0.0 network to the SA on the M0N0WALL, but that really aggravated it and the SA never came up, so I reverted.

I have checked all the firewall rules to make sure nothing is blocked. All of the Sonicwall auto-added rules look right.

Specs:

Sonicwall TZ200, Enhanced OS

M0N0WALL v1.32

I'm at a loss at this point. Any help would be appreciated.

share|improve this question
    
What are you using for the gateway at the LAN A end of the VPN to B? –  Paul Oct 21 '12 at 0:31
    
Paul - Virtual Amazon router. On the ingress of that VPN, it's a dedicated Cisco router. –  John Virgolino Oct 22 '12 at 12:50
    
For Amazon Virtual Private Cloud, you might ask at forums.aws.amazon.com/forum.jspa?forumID=58 Their VPNs may play by their own rules, like recommending two tunnels and BGP routing. –  Paul Oct 22 '12 at 14:51
    
Paul - that part of the traffic is working well. We do have the dual tunnel and BGP working and traffic is passing between the networks. The Sonicwall is seeing that traffic, it's just not pushing it onto the VPN to LAN C. –  John Virgolino Oct 22 '12 at 16:01
    
Haven't used Sonicwall so I don't know what options & debugging tools are available. The ipsec tunnels I've done on Cisco gear were picky about the subnets defined on each end. Would it be worth trying with a smaller scope on the Sonic side of the SAs with Amazon...that doesn't include both 10.14 and 10.18? If the VPC's default route sends packets to a Sonicwall interface, and the Sonicwall's routing table has a valid next hop for 10.32, it seems a VPC-sourced packet to 10.32 should get thru m0n0wall. –  Paul Oct 22 '12 at 17:17
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.