VPN Traffic Affected by Route Hops?

[indraadi82]

Dear Experts,

Recently we tried to establish VPN communication to a foreign country (Denmark) using 2 firewalls. From Denmark side, they claimed to have established the VPN tunnel, but they can not send any traffic to our side. But they said that traffic from our side is going normally to their side. So, it looks like it's a one-way-communication inside the tunnel.

Denmark side said that after looking at the traceroutes (to each sides) compared between ours and theirs, the difference in route hops (going and returning) caused this problem. Is this true? can those different hops cause one-way-communication VPN? Honestly, I thought it was supposed to be firewall settings that could be incorrect. Does hop really matters?

Thanks! 

[Francesco Molino]

Hi

Can you share more details please? Where are located the different hops? I mean if both way routing isn't the same, this means probably you have asymmetrical traffic and if this going through a firewall, by default it's dropped. That's why I need more information/clarification.

Also, have you ran a packet capture to see if ingress and egress ipsec packets are seen?

[indraadi82]

Hi Francesco,

In brief, this is the traceroute result (ISP name is written after the Hop count#):

Traceroute to our side (from DK):

HOP-1: TDC
HOP-2: TDC
HOP-3: TDC
HOP-4: TDC
HOP-5: TDC
HOP-6: ***
HOP-7: LV3 (NAP's upstream)
HOP-8: NAP
HOP-9: ***
HOP-10: ***
HOP-11: NAP
HOP-12: JSTEL (Arrived at destination IP)
------------------------------------------

Traceroute from our side (to DK):

HOP-1: JSTEL
HOP-2: JSTEL
HOP-3: JSTEL
HOP-4: NAP
HOP-5: NAP
HOP-6: NAP
HOP-7: TELIA
HOP-8: TELIA
HOP-9: TELIA
HOP-10:TELIA
HOP-11: TDC
HOP-12: TDC
HOP-13: TDC
HOP-14: TDC (Arrived at destination IP)

Sorry, but at this time I can't run a packet capture yet. I hope the above route hop can help.

Thanks!
Indra

[Francesco Molino · Accepted solution]

Can you give more details on both side like how the routing is done? Bgp?

The last hop on both side is the firewall? Is the packet arriving on the same end device? Even if there's asymmetrical routing in between it doesn't matter, the end device receiving the traffic matters.

Can you also share outputs/configs from both side? Outputs would be show crypto isakmp and ipsec.