VPN Tunnel with remote source network

[yasaman64]

                   Hi Everyone,

I've been working with VPN for sometime now but I got confused over this senario, can anyone help me on this?

i have a firewall and a router behind the firewall is going to route all IP addresses from subnet 10.2.2.0 destined fro 10.3.3.0 to my firewall so i can create a tunnel to a remote site with the intresting traffic of

local : 10.2.2.0 and remote: 10.3.3.0. but the thing is 10.2.2.0 is not local to my firewall and my firewall's inside IP address is 10.10.10.1.

so my question is is this doable or not and if not what whould be the solution for it?

Than you so much.

[Karsten Iwen]

The "interesting traffic" for the VPN doesn't have to be locally connected to the VPN-gateway. In fact, if you have a clean network-design it nearly never is. From the firewall you have a transfer-nertwork to a L3-switch where your user-networks are connected. For the vpn-gateway these user-networks are all reachable through the L3-switch. But the traffic for these networks can be protected by the vpn-gateway without any problems.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

[yasaman64]

Thanks Karsten, so I dont have to have a sub interface on my firewall in the subnet of my user-network? just define the interesting -traffic from 10.2.2.0 to 10.3.3.0?

[Karsten Iwen]

That's right. The rest is done by pure routing to and from your VPN-gateway.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

[yasaman64]

the router in my firewall lan is going to route the packets destined for remote network(10.3.3.0) to my firewall. do i need a route on my firewall to route the 10.3.3.0 destined packets to WAN default Gateway?(although i have a vpn tunnel for that?)

[Karsten Iwen]

Yes, without a route for the remote-network, the packets wouldn't get to the outside-interface where the crypto-map is waiting for the packets to protect them.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

[yasaman64]

No crypto map in on my firewall, what i am saying is do i need a route on my firewall to the remote protected network to go through the default wan gateway?

[Karsten Iwen]

Yes, you need a route. But what device are you talking about if you don't have a crypto-map?

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

[yasaman64]

I have crypto map on my firewall, so i think i get it now, i need a route on my firewall which my crypto map in on to the remote network which is the destination for interesting traffic.

thank you so much Karsten