printer on a different subnet over VPN

xomchua76 · ‎06-06-2007

I have an ipsec VPN up and running between site A and B. The two site can communicate well.

Site A:

506E with IOS 6.3

subnet: 10.7.7.0 255.255.255.0

server: 10.7.7.3

Site B:

Sonicwall

subnet: 192.168.1.0 255.255.255.0

printer: 192.168.224.34

How can I print from the server at site A to a printer at Site B?

Right now, I have an ACL list as below:

access-list printerACL permit ip host 10.7.7.3 192.168.1.0 255.255.255.0

access-list printerACL permit ip host 10.7.7.3 192.168.224.0 255.255.255.0

I have no luck talking to the printer at site B

Jon Marshall · ‎06-07-2007

Hi

Is there a typo in Site B config. The subnet is 192.168.1.0/24 but the printer is 192.168.224.34.

When you say the two sites are communicating well it that between the 10.7.7.0/24 network and the 192.168.1.0/24 network only or both the 192.168.1.0/24 network and the 192.168.22.34 network ?

Jon

xomchua76 · ‎06-07-2007

Jon,

Not a typo. The printer is on a different subnet. That's why I need help. Communication well means the subnet between 10.7.7.0/24 and 192.168.1.0/24.

Jason

Jon Marshall · ‎06-07-2007

Jason

Have you included the subnet 192.168.224.0 in your cryto map access-list and has the sonicwall also been configured with that subnet ?

Jon

xomchua76 · ‎06-07-2007

Jon,

Yes, both side have the subnet 192.168.224.0/24 in their crypto map. When I do a ping from the server @ site A, I don't see any thing hitting the sonicwall @ site B. I don't know where packets get drop.

Jason

acomiskey · ‎06-07-2007

What about nat 0?

xomchua76 · ‎06-07-2007

Already applied NAT 0, I know packages don't go through the outside interface.

Jason

acomiskey · ‎06-07-2007

I assume the printer has a gateway? You can print to it from 192.168.1.0?

xomchua76 · ‎06-07-2007

Acomiskey,

Yes. The printer has a gateway.

Jason

Jon Marshall · ‎06-07-2007

Jason

Have you tried debugging on your pix firewall to make sure that

1) packets are hitting the firewall destined for the printer on the inside interface.

2) encrypted packets are leaving the outside interface. If there is a lot of VPN activity then it will be difficult to tell with this one but sometimes it if your run 1 & 2 together it can be quite clear that packets are hitting the inside and then leaving the outside.

Also are there any other devices on the 192.168.224.0 network you could test connectivity against.

Jon