06-03-2003 11:10 AM - edited 02-21-2020 12:35 PM
Greetings,
Because of specific requirements, I need to allow my vpn clients connected to my 3030 to be able to communicate with one another over the encrypted tunnel.
In the current configuration, the vpn clients can communicate with all the networks and hosts behind the 3030. However, I can't seem to get client to client communication to work (testing via pings) and I was hoping someone
can help.
Initially, I tried this running 4.0 sw on the 3030 and using 4.0 vpn clients. I tried changes on the interface, group and client fw filters and network lists but still couldn't ping, including removing group and client fw filters. I also turned off split tunneling but still no luck. The original IP pool consisted of addresses on the same subnet as the private interface on the 3030 but the addition of IP pools on totally separate subnets still did not get me connectivity.
I also tried all of the above steps with version 3.6.1 of the concentrator sw but that didn't work. The reason I tried that version of the 3030 sw is because I was able to get client to client connectivity to work in another environment using version 3.6.1. I didn't switch the VPN client because I was able to confirm that client connectivity works under 4.0. BTW, the OS on the clients is XP and I made sure that there were no firewalls or packet filters turned on.
One difference in this environment vs my previous working environment is that instead of a router sitting behind the 3030 it's a PIX 515. But the ICMP packets should, in theory, never leave the 3030. BTW, pinging the connected vpn clients from the PIX works which means routing shouldn't be an issue either.
Any suggestions? Thanks in advance.
06-05-2003 11:45 AM
Hi,
Until I know, due to security it's impossible to re-route a packet to the
same interface you receive it (reverse-path-check). So, if you want to
connect client-to-client you need a tunnel between them
Franzin
09-03-2003 06:53 AM
I have a similar situation. 2 - 3002's need to communicate to each other over an encrypted tunnel. Both 3002's are connected to a 3030, acting as a hub. Can this be done?
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: