topic Re: printer on a different subnet over VPN in Network Security

printer on a different subnet over VPN

xomchua76 — Mon, 11 Mar 2019 10:26:10 GMT

I have an ipsec VPN up and running between site A and B. The two site can communicate well.

Site A:

506E with IOS 6.3

subnet: 10.7.7.0 255.255.255.0

server: 10.7.7.3

Site B:

Sonicwall

subnet: 192.168.1.0 255.255.255.0

printer: 192.168.224.34

How can I print from the server at site A to a printer at Site B?

Right now, I have an ACL list as below:

access-list printerACL permit ip host 10.7.7.3 192.168.1.0 255.255.255.0

access-list printerACL permit ip host 10.7.7.3 192.168.224.0 255.255.255.0

I have no luck talking to the printer at site B

Re: printer on a different subnet over VPN

Jon Marshall — Thu, 07 Jun 2007 16:49:36 GMT

Is there a typo in Site B config. The subnet is 192.168.1.0/24 but the printer is 192.168.224.34.

When you say the two sites are communicating well it that between the 10.7.7.0/24 network and the 192.168.1.0/24 network only or both the 192.168.1.0/24 network and the 192.168.22.34 network ?

Jon

Re: printer on a different subnet over VPN

xomchua76 — Thu, 07 Jun 2007 17:01:26 GMT

Jon,

Not a typo. The printer is on a different subnet. That's why I need help. Communication well means the subnet between 10.7.7.0/24 and 192.168.1.0/24.

Jason

Re: printer on a different subnet over VPN

Jon Marshall — Thu, 07 Jun 2007 17:03:48 GMT

Jason

Have you included the subnet 192.168.224.0 in your cryto map access-list and has the sonicwall also been configured with that subnet ?

Jon

Re: printer on a different subnet over VPN

xomchua76 — Thu, 07 Jun 2007 17:19:22 GMT

Jon,

Yes, both side have the subnet 192.168.224.0/24 in their crypto map. When I do a ping from the server @ site A, I don't see any thing hitting the sonicwall @ site B. I don't know where packets get drop.

Jason

Re: printer on a different subnet over VPN

acomiskey — Thu, 07 Jun 2007 17:22:27 GMT

What about nat 0?

Re: printer on a different subnet over VPN

xomchua76 — Thu, 07 Jun 2007 17:26:26 GMT

Already applied NAT 0, I know packages don't go through the outside interface.

Jason

Re: printer on a different subnet over VPN

acomiskey — Thu, 07 Jun 2007 17:34:15 GMT

I assume the printer has a gateway? You can print to it from 192.168.1.0?

Re: printer on a different subnet over VPN

xomchua76 — Thu, 07 Jun 2007 17:54:12 GMT

Acomiskey,

Yes. The printer has a gateway.

Jason

Re: printer on a different subnet over VPN

Jon Marshall — Thu, 07 Jun 2007 18:02:09 GMT

Jason

Have you tried debugging on your pix firewall to make sure that

1) packets are hitting the firewall destined for the printer on the inside interface.

2) encrypted packets are leaving the outside interface. If there is a lot of VPN activity then it will be difficult to tell with this one but sometimes it if your run 1 & 2 together it can be quite clear that packets are hitting the inside and then leaving the outside.

Also are there any other devices on the 192.168.224.0 network you could test connectivity against.

Jon