VPN issue when merging two networks

[sdesbrough]

NETWORK 1 : We have a WAN that consists of a Main Branch and three remote locations with a PIX firewall at the Main Branch and branches connect to the Internet through the Main Branch PIX. This is a 192.168.X.X network. We use Cisco Secure VPN Client to connect to the PIX and are able to reach all devices at all branches within this WAN. The VPN IP address pool is 172.16.X.X. This works perfect.

NETWORK 2 : Due to a company merger, we are merging networks. The Network 1 main branch is now connected to another WAN via a T1 connection. We use Novell servers and the company that purchased us now has the Novell TREE and control of our network. We have Cisco IP Telephony and we are able to reach their entire network as well as they connect to ours. The workstations on this network are 10.X.X.X but the servers are 192.168.X.X (Their application software is outsourced thus they have static IP addresses and that is why there is a difference in the ip networks)

We would like to be able to connect to our VPN on Network 1 and be able to reach any device within the either network. It seems like this should be possible since there is not a firewall between the two networks and it doesn’t seem that it would be any more difficult to reach the main branch of network 2 than it is one of our branches on network 1 as the connectivity is all the same. I believe this is a routing issue but our network support says this cannot be done. We cannot reach any device on network 2 when connected via VPN.

Please let me know if this can be done.

[sachinraja]

hi sdesbrough,

This can be done, if your old & new networks are inside the pix firewall and reachable from the pix firewall. there will be no problems in this. YOu just need to make sure of your routing. make sure of the following things:

1) Route to the new network on the pix firewall pointing to any adjacent router on the inside.

2) Route to the ip pool from the new network's router. You should be able to ping any connected IP from this new network and vice versa.

3) once you are able to ping, you have 80 % success.

4) make sure you have the new networks pool on the nonat access-list. Only by doing this, you can establish communication between the subnets.

5) Check if the inside access-list (if any) on the PIX is allowing connections from your new network to the IP pool.

if all these are fine, you should be able to access the new network when connected on VPN.

Note: you have to have the new network connected on the inside segment. if it is on the outside, you cannot access the network components.

hope this helps.. all the best...

Raj

[sdesbrough]

Thank you very much. Its working great!