Clients behind VPN Concentrator can't ping a subnet, but the concentrator can. Routes in place.

[support]

Hello and thank you for reading,

We have a VPN Concentrator 3000, it works for all the sites except for a new one we just added. There is communication between the Concentrator and the office, but we can't ping the clients behind the concentrator.

Traceout shows that the traffic reaches the concentrator, but it never makes it back. There is no firewall in between.

Office switch:

Tracing the route to 172.18.1.103 <- VPN Client
VRF info: (vrf in name/id, vrf out name/id)
1 10.4.1.7 10 msec 0 msec 0 msec
2 10.120.0.90 30 msec 20 msec 20 msec
3 10.120.0.2 20 msec 30 msec 20 msec
4 10.120.0.1 20 msec 20 msec 20 msec
5 10.0.12.1 20 msec 20 msec 30 msec
6 172.16.1.2 20 msec 20 msec 30 msec
7 172.16.1.5 20 msec 20 msec 20 msec  <- VPN Concentrator

The configuration is the same on all the switches, and I added the new subnet to the list of static routes on the VPN Concentrator. 

Any help on this will be greatly appreciated.

Thanks

[Philip D'Ath]

Windows firewall?

[ndhingr3]

The subnet pool for the VPN Clients (172.18.1.0) is different than the internal subnet (172.16.1.0). So, can you verify if you have the proper routes for the VPN pool subnet?

Please share the configuration of the concentrator as well.

[support]

Hi ndhingr3,

Thank you for your reply. As you can see in my original post, the "Traceroute" to 172.18.X.X does travel all the way to the VPB Concentrator, so the routes are there. For some reason, the VPN concentrator does not route it.

Here's the routing table of the VPN Conc.

0.0.0.0 0.0.0.0 63.117.231.1 2 Default 0 1
10.0.0.0 255.0.0.0 172.16.1.250 1 Static 0 1
10.1.0.0 255.255.0.0 172.16.1.250 1 Static 0 2
10.2.0.0 255.255.0.0 172.16.1.250 1 Static 0 2
10.3.0.0 255.255.0.0 172.16.1.250 1 Static 0 2
10.4.0.0 255.255.0.0 172.16.1.250 1 Static 0 1
63.117.231.0 255.255.255.0 0.0.0.0 2 Local 0 1
172.16.0.0 255.240.0.0 0.0.0.0 1 Static 0 2
172.16.1.0 255.255.255.0 0.0.0.0 1 Local 0 1

10.4.X.X is the subnet having issues. However, I can ping the inside of the concentrator.

Thanks in advance!