Routing to VLAN threw VPN

[Kryption224]

I have a network already in place that has 3 offices. They connect by using Cisco's Pix and a VPN tunnel. Everything is talking and running fine in this setup. The default gateway is the Pix at each location, the last octet at the location for the Pix is 1.
HQ = 192.168.10.0/24
Br2= 192.168.20.0/24
Br3= 192.168.30.0/24


The problem that I am currently having is that I created a VLAN network at HQ.
VLAN 101 = 192.168.10.0/24
VLAN 102 = 172.16.22.0/27
VLAN 103 = 172.16.22.32/27
PIX e1 = 172.16.21.2/30
3550 f0/1 = 172.16.21.1/30
ip routing is enabled

The only network that I am trying to get up first is the 192 network. I will then move my users over to the other VLAN at a different time. I just need to get the users on to the Cisco equipment. the gateway at HQ VLAN 101 is 192.168.10.1.

I have added the other VLAN IP addresses to the crypto map at the other locations but I am only trying to get to the 192.168.10.0 network from those locations at the present time.

The internal network is working. I can ping and connect to others in the VLAN and access the internet. When I connected the VLAN to the PIX I could connect to the other locations using RDP, telnet, FTP and ssh. So I know what everything is configure to connect. I am pretty sure that my problem is routing related, but dont understand why? On the Pix I have a static route for inside 172.16.21.2 to 172.16.21.1 and added the route inside 192.168.10.0/24 to 172.16.21.1, is that right? Because the next hop from the Pix is to the switch f0/1 that is 172.16.21.1. And I am thinking that the 3550 Layer 2 & 3 routing port should route to the VLAN 101.
On the 3550 I have the static routes to the VLAN and 101 is on the 3550 so there is no trucking issues.

There is no access-l on the 3550 so every is permit.

Is there a route that is needed or something taken out that allow that traffic from the other locations to VLAN 101?

 

[burtsbees]

At first, it looks like you cannot connect to the VLAN behind the PIX from anywhere, but when you externally connect to the PIX vlan, you can then connect to other vlans...is this correct?

Burt

 

[Kryption224]

I am unable to connect to the VLANs at HQ from Br2 and Br3. But able from HQ to connect to the other locations.

192.168.10.0/24 is an existing network that has the business system on it and the current network. I will be converting over to the other VLANs later. I just need to get the users on the cisco equipment for now.

Its like theres something stopping the traffic from the outside to inside the 3550.

I have no access-l what so ever, so that means that is a permit any on the interface, correct?

 

[Kryption224]

Do I need an ACL on the 3550 f0/1 to allow the traffic in?

 

[burtsbees]

What's BR2 and BR3??? You're gonna have to post some sort of ASCII diagram and configs...as well as what VPN's into what...

You do not need an acl to allow traffic on a 3550, but in a PIX you do.

Burt

 

[Kryption224]

BR2 and BR3 are the other location that are connected through the VPN with the Pix firewall.

I will post the Config tonight, but here is the Visio of what is happening.

 

[burtsbees]

Crap---it's in your first post...I'm blind. I will look at this later...

Burt

 

[Kryption224]

Sorry that I havent not replied in sometime. I figured out the problem. It did not lie with the VLANs, it was a NONAT issue. I was not pointing the address inward.

Thank You for the help.