Clients from one network cant ping clients on another network

[nopea]

Hi,

Can anybody here seem to figure this one out…

I have recently setup a VPN that connects my home office network in Japan to our network in the U.S. Our office uses Windows 2003 machine as the center of the network. It has two NICs, with one NIC we use RRAS and a demand-dial setup to connect to our ISP with PPPoE (our connection is a 100mbps fiber connection). The other NIC is used for our private network. The two clients in that network can access the Windows 2003 with no problems, as well as having internet connection through the Windows 2003 box.

Our network in the U.S is two machines at a datacenter, both running Windows 2003 Enterprise Edition. These machines also have two NICs, one NIC is for their connection to the datacenter (Internet) and the other NIC is for the private network between the two machines.

How I made the connection is use RRAS on our Windows 2003 machine and made a demand-dial connection to one of the machines on our U.S network (only one machine has RRAS setup), I also made the demad-dial interface for the answering end as well. I can make the connection without any problems, authenticate and assign valid IPs. However not all the machines can talk to each other.

More Details:
Our office network uses the 10.1.4.0 network ID with a subnet mask of 255.255.255.0; our U.S private network is on 192.168.0.0 with a subnet mask of 255.255.255.0, so both on their own subnet. In RRAS on the Windows 2003 box in the office we have added the static route to the demand dial interface (that connects to the VPN server in the U.S) a destination of 192.168.0.0 and on the VPN server in the U.S we added the static route of 10.1.4.0 to the demand-dial interface connecting to our Windows 2003 machine.

If you take a look at our network map at

http://swavideo.com/net_map.gif

the computer ‘nagoya’ dials in to ‘lionsgate’ again the connection is not a problem. From ‘nagoya’ I can ping both ‘lionsgate’ and ‘burnaby’ (again you will need to look at the map to see which machine I am talking about). However from either ‘littleboy’ or ‘kits’ I can ping ‘lionsgate’ only but not ‘burnaby’. I tried to ping from ‘lionsgate’ to ‘littleboy’ or ‘kits’ and there was no problem there (only problems is when trying to connect to a share on ‘littleboy’ or ‘kits’ I only lets me choose the guest account to access the shares with).

Any ideas as to why the machine making the connection can access all clients on the remote network, but the clients on our local network can only make connections to the VPN server on the remote network?

I hope this is clear enough… makes my head spin myself.

Thanks,
Chris Hawkins

 

[pmf71]

A better way of making a permanent Gateway-to-gateway VPN tunnel without the use of any hardware appliances is using IPSec policies to create an IPSec Tunnel. Works much better than PPTP.

Here's a link to a knowledge base document that explains how to configure it:

http://support.microsoft.com/default.aspx?scid=kb;en-us;252735

 

[nopea]

Thanks for the suggestion.

I looked at the link, and tried it out... but this would basically block all traffic on the internet connection (except for that for the IPSec).

Chris

 

[pmf71]

No it doesn't actually... only WAN traffic is routed over the tunnel, internet traffic is neatly routed straight to the default gateway. I've used this setup before, and it works like a charm.

 

[nopea]

Looking at the article the idea seems to be what we need... but would this link both networks or just the two machines doing the connecting?

Chris

 

[pmf71]

gateway to gateway means the subnet are connected, so yes...both networks are actually connected.

the cool thing about using IPSec policies is that you don't even need the gateways to have a server OS... windows 2000 pro or XP pro support it too, although you would need to manually add any needed static routes from the command console if you were to use PRO versions of windows (server has a routing console).

 

[nopea]

Yeah I would need our Windows 2003 RRAS box to route it; this is the same machine that is the gateway too.

If I am not mistaken I wouldn't need a 'dialer' on this because the IPSec Policy would route all traffic that has the destination of the other private network through the internet to the destination IP set int he policy?

Also would this need to be setup on both machines each with two policies (I assume yes)?

Again thanks for your help,
Chris

 

[LloydSev]

Yes.. the other network would need a policy to route traffic on that network to the IP on the 2003 RRAS box.

Computer/Network Technician
CCNA

 

[nopea]

Thanks for everybody's help!

I couldnt get that meathod to work - maybe I will try again later when I have some more time, it sounds more secure.

In the meanwhile what I have done is setup a standard VPN server on one of my boxes at the datacenter (Windows 2003/RRAS) and created a demand dial interface on our RRAS here in the office. I think the reason why the clients on my nework coulcnt ping the VPN server (when the machine that was actually connecting good) was because access to the internet for the clients go thru NAT. So I added the demand -dial interface to NAT as a public interface and the clients could then ping all the machine on the remote network.

This will work for now till I have more time to play with the IPSec policies.

Chris

 

[pmf71]

It took me some time to figure it out too...best thing is to make a test setup.

I had the misfortune that when i tried this, the machines i used had windows 2000 with SP3. turned out NAT-T wasn't supported yet...that didn't come till SP4..spent nearly a month trying to figure that out. After SP4 was installed, it worked like a charm.