3030 Concentrator: Lan to Lan VPN problem on Private Interface

Unanswered Question
May 23rd, 2007

Hello,

I have a 3030 series concentrator, with three interfaces.

"Ethernet 1 (Private)" faces our internal network. It's IP is 10.1.1.1 (of course IPs have been changed to protect the innocent).

"Ethernet 2 (Public)" faces the Internet. It's IP is 70.70.1.1.

"Ethernet 3 (External)" faces our company WAN. It's IP is 192.168.1.1.

For routing, our default route points out Ethernet2 towards the Internet, and we have static routes facing inside and to our WAN.

Most of our Lan to Lan VPNs are built over the Internet, and work fine. However, we have some sites that we want to VPN with, over our WAN.

So for Ethernet3, we modified it to be a Public Interface (by selecting the checkbox), applied the Public (Default) filter, and added static routes for our partner VPN devices.

However, we cannot initiate the VPN. We've setup a network sniffer, and found the problem.

Let's say our remote VPN endpoint is 192.168.3.3. And we have a static route out Ethernet3 for that.

During IKE phase1, the conversation is correctly between and 192.168.1.1 and 192.168.3.3. However, once ESP starts, the source of the packets becomes 70.70.1.1.

That public IP (70.70.1.1) is of course not routable on our WAN. So we never get any reply packets from our remote VPN peer (192.168.3.3).

Here's a more detailed packet trace...

192.168.1.1 192.168.3.3 ISAKMP Identity Protection (Main Mode)

192.168.1.1 192.168.3.3 ISAKMP Identity Protection (Main Mode)

192.168.1.1 192.168.3.3 ISAKMP Identity Protection (Main Mode)

192.168.1.1 192.168.3.3 ISAKMP Quick Mode

192.168.1.1 192.168.3.3 ISAKMP Quick Mode

70.70.1.1 192.168.3.3 ESP ESP (SPI=0x2eb63db6)

70.70.1.1 192.168.3.3 ESP ESP (SPI=0x2eb63db6)

70.70.1.1 192.168.3.3 ESP ESP (SPI=0x2eb63db6)

70.70.1.1 192.168.3.3 ESP ESP (SPI=0x2eb63db6)

What could be making the VPN Concentrator switch what IP it sources the packets from?

Thanks!

Bill

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
drolemc Tue, 05/29/2007 - 10:48

Try this steps:

>Check internal routing on the concentrator

>Inserted the static route on the inside router which connected to the private interface of the concentrator

Try these links:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/products_configuration_example09186a00800949d2.shtml

http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a00800949f1.shtml

Actions

This Discussion