Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Unable to access internal lan instance from remote vpn instance

Hello,

Key players:

10.10.10.11 : Corporate machine.

10.10.10.2 : Cisco 881 configured to act as our tunnel to the remote data centre.

10.10.10.1 : Cisco 5510 is our corporate LAN gateway and access to the outside world.

172.16.100.5 : A machine at the remote end of the VPN that I can ssh into but cannot ssh back from.

I have a VPN configured to another data centre. It works successfully in the sense that I can ssh from my internal corporate network (10.10/16) to a remote instance (172.16/16). The configuration is like this:

10.10.10.11 -> Cisco 881 (10.10.10.2 : tunnel provision) -> Cisco ASA 5510 (10.10.10.1) -> Internet -> Remote VPN Gateway -> 172.16.100.5.

However, I cannot ssh *back* from 172.16.100.5 to an instance on my local network, i.e.:

172.16.100.5 -> Remote VPN Gateway -> Internet -> Cisco ASA 5510 (10.10.10.1) -> Cisco 881 (10.10.10.2 : tunnel provision) -> FAIL

I *can* ping the Cisco 881, i.e.,

Pinging *from* 172.16.100.5 *to* 10.10.10.2 I get an echo reply.

If I try to ping anything else (and by extension ssh as described above), it does not work (i.e., ping or ssh 10.10.10.11).

This is really confusing me.

My thought would have been that as soon as traffic comes from 172.16.100.5 to the Cisco 881, it decrypts it and then simply forwards the encapsulated packet on to 10.10.10.11 via our gateway (10.10.10.1).

Anyone got any thoughts on this?

Thank you!

-=david=-

Everyone's tags (5)
422
Views
0
Helpful
0
Replies
CreatePlease login to create content