Secureremote client connection through site-to-site VPN

[mdc1973]

Need some help if possible...I have a Checkpoint NG AI R54 firewall with a VPN to a Pix (not managed by me). There are also Secure Remote users connecting to the Checkpoint, who are assigned an IP in the 172.x.x.x range by the firewall.

I currently have a problem whereby a secure remote user wants to get to servers behind the Pix (IP 10.x.x.x). ie connect to the Checkpoint via secure remote then back out the same (external) interface to cross the VPN to the Pix.

I have rules in place as follows:

Src: secure-remote users
Dest: all internal nets + 10.x.x.x
VPN: remote-access VPN

and

Src: all internal nets + secure remote IPs
Dest: 10.x.x.x
VPN: site-to-site VPN

At the moment, when a connection is made to a server behind the pix, I can see in the logs the packet being decrypted using the secure remote rule. However, output of a tcpdump on the external interface shows the echo-request from 172.x.x.x to 10.x.x.x but nothing coming back (icmp is allowed across the tunnel). This makes me think the packets are not being encrypted although the 172.x.x.x range is part of the encryption domain.

Hope this makes some sort of sense, but any ideas of a) whether this is possible to get working and b)...how?

 

[mdc1973]

Sorry, it's secure client, not secure remote...

 

[ansellrk]

Just a thought... I assume that your Checkpoint to PIX VPN tunnel is defined in the VPN communities as a Site to Site? If it is have you configured it to talk to 'Center' only? Is it possible that it needs to be allowed to route to 'other VPN targest'?

I may be well off target here but it is all I can think off!?

 

[ROUTERKID1]

make sure the servers/network behind the pix are part of the encryption domain.