IP Range Overlap

[JillofAllTrades]

I have finally figured out why sometimes my remote users cannot connect to email from various locations.

I use 10.0.0.x internally, and when the remote location also uses that range, viola, no email connectivity. They have a hosts file entry that says emailserver is at 10.0.0.12 but of course the pc is looking at the "local" 10.0.0.12 instead of going out over the VPN connection to "my" 10.0.0.12.

What can I do to resolve this, short of changing my entire internal IP address scheme?

Thanks in advance!

Christine

 

[nsantin]

Not the easiest solution for non-technical users, but after the user connects they can modify the local route table.

from a command prompt:

>ROUTE DELETE 10.0.0.0
>ROUTE ADD 10.0.0.0 MASK 255.255.255.0 x.x.x.x METRIC 1

where x.x.x.x is there IP address once connected.

Note, some VPN clients will not allow you to change the route table once connected.

 

[JillofAllTrades]

That actually wouldn't be too hard, since they have static IP addresses for their VPN connections.

I will test that, thanks!

Christine

 

[lgarner]

Some VPNs, like Cisco, allow you to disable local LAN access completely, which would also solve the problem.

 

[gacollier]

Jill,

Did you resolve this? If not, read on...

Are you saying that your have two networks connected via VPN (IPSEC?) that have the same network subnet address? (ie. network 10.0.0.X/255.255.255.0 connects to network 10.0.0.X/255.255.255.0) Let me know if I've read your post correctly.

 

[JillofAllTrades]

I haven't tested the solution yet to know if it works.

My corporate network is 10.0.0.x/255.255.255.0.
My mobile workers sometimes stay in locations with high-speed access that also use a network of 10.0.0.x/255.255.255.0.
When this happens, they are unable to connect to our resources, as their laptop looks to the local network for these addresses.

I am using a Windows 2000 Server RAS PPTP VPN - very simple set up. I have static IP addresses assigned to the mobile workers via Active Directory.

The only option I have on the client end is to "Use the default gateway on the remote network" which will send traffic through the VPN connection if it can't be located on the local network. Setting this doesn't help.

As soon as one of those pesky mobile workers calls to complain again, I will try adding the route. ;-)

Christine