Routing

[drize]

I setup a single VPN tunnel from a machine within the LAN. No problem there, the Cisco client connects to the outside VPN cluster and all works fine.

Now, I need to use it as the gateway for other machines that need the same VPN. The goal is to allow the client to dynamically create routes that allow it to see the local network and distant network at the same time. Then, the Cisco client will know what subnets to use for the "allow access to local LAN" option.

With DHCP, I setup the VPN machine as the gateway for other machines that need the VPN. I did this by defining a route that points to the gateway for any traffic that requires the specific external network. So, in theory, all traffic to the outside network should be routed through that VPN machine. When I launch the application from another machine, it does not find the VPN tunnel.

Instead, I setup VPN tunnels from each machine, but that is not preferable. Would be grateful for any ideas and advice.

 

[brianinms]

What you need is a site to site vpn using a hardware appliance.

 

[Serbtastic]

Your Cisco VPN client would have to allow for a split-tunnel for this to work. Also, how are you sharing the tunnel? Using ICS or some third party application?

 

[drize]

brian,

the reason i am setting this up is because i dont have the option of setting up a site to site vpn.

serb, yes, the split tunnel on the CISCO client works fine. the problem is that it only detects and allows local access to the subnet(s) in the routing table. in my network, that is not sufficient to access all network resources. not sure what you mean about sharing the tunnel - i just established on unique tunnel with the CISCO client and tried to route all related application traffic from other machines through that point. in theory this is possible, but in practice, well, that's where the fun starts.

 

[Serbtastic]

Microsoft says you should be able to use ICS to share the VPN tunnel:

http://support.microsoft.com/kb/234773

 

[drize]

serb,

actually, that article proposes that i setup the vpn from each client. however, i need to setup only one vpn tunnel and have all clients (about 5 machines) route specific traffic through that one host with the vpn already up. that way, they can access the remote network and local resources at the same time.

not sure ics is going to help me here.