Working VPN But Onward Routing Problem

[Steve30]

Hi All,

I have successfully set-up a working IPSEC 3DES VPN between two sites using a Cisco 515 (centre-site A) and Cisco 501 Pix (remote site B).

At the centre site their is an existing WAN leased line connection to a third site (site C) whos LAN is 192.168.200.0 Both the centre PIX and leased line router are plugged into the same switch and are on the same network.

The problem I have is, how do I get IP traffic through the VPN from Site B LAN to site A over the VPN then onto site C down the leased line to their LAN?

Hope someone can help me with this one, I have tried many things!

Thank you.

Steve.

 

[mbilgrav]

you can not.
The PIX will never sent a packet out the same interface its recieved.

Inorder to do what you what, you need eigther tunnel from B-C or have two interfaces towards the WAN on site A, then router in the first and out the sec.

Cisco web has a config example just about this senario.

 

[INT1973]

You can try the following on the PIX :
Assuming that the default route on the Lease line router is the PIX ,


Add the statements on the PIX -

1. add a Route inside statement to the network 192.168.200.0 via lease line router.
2. add access-list statement to permit access to 192.168.200.0 network
3. apply the access-list


examples :

1. access-list 100 permit ip 192.168.1.0 255.255.255.0 172.16.10.0 255.255.255.0

2. route inside 192.168.200.0 255.255.255.0 192.168.1.0 1

3. nat (inside) 0 access-list 100

Make sure you have the latest IOS on the PIX. I would recommend 6.3.3.132

Try to ping the Lan hosts and see if it worked.

Hope this works

 

[mbilgrav]

Oh indeed - I didnt think the phrase:

"Both the centre PIX and leased line router are plugged into the same switch and are on the same network."

was reffering to the inside, but indeed, is the WAN is on the Inside, yes you can.

you might catch my drift here:

http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a0080103ed0.shtml

 

[Steve30]

Hi,

Yes, I overlooked the fact that the PIX will not route packets out of the same interface they come in on.

Also the default route on the leased line router is not the PIX as this is managed by a third party teleco, and can not be changed.

Any further ideas anyone ? Or should I look at a differenet solution for this problem...

Thanks.