IPSEC Tunnels and routing

[bp1169]

Hope someone can help, this has got me stumped. I have a layout that looks something like this

5 offices--5 routers -- 1 Core Router---PIX FW-(ipsec via internet)--router--branch office.

The problem occurs when routing traffic from the branch office via the ipsec through the internet in through the pix and out on the internal network. The office which is VPNing into our network makes the connection fine and can connect to several of the subnets perfectly, however, randomly and without reason they periodically cannot connect to some of the offices on the internal network. They can still however access other internal network branches. There have been no internal network problems so I am certain it has something to do with the ipsec tunnel. There is no routing on the branch router, just a static route to the downstream internet router. I have routes set in the firewall to direct internal appropriate traffic. I am looking for any ideas as to where this problem may lie. Thanks for any assistance

 

[sobak]

How do you get the connection to come back up? Can you issue a....

clear ipsec isakmp
clear ipsec sa

Does the VPN connect to all the other networks after running the above clear commands?

When the branch office loose connection to the other networks, can you establish access to a box (either workstation or server) in that office and run some traces? If you have a sharp user they could run a trace from their desktop if you can't connect. The trace will give you an idea what piece of equipment is failing or if it's the VPN that is causing you problems. If you can trace to the network that is not responding and one that is responding it should give you some idea of where to start troubleshooting.

I had a similar problem with remote office connections over a VPN. Working with Cisco it took me about four months to figure out the problem. Your situation is a little different since it sounds like your VPN tunnel is still up and responding to parts of your network but loose connections to others does not sound like a VPN issue.

Are you running any routing protocols at all?

david e
*end users are just like computers, some you can work with...others just need a simple reBOOTing to fix their problems.*