VPN client > branch office > head office

[nmackovski]

My remote users can successfully connect to their branch office (Cisco 3005 Concentrator) and access all resources on LAN. However, they cannot access resources located at head office? The branch office has a LAN-to-LAN tunnel to head office. Users physically located at branch office can access resources at head office through the LAN-to-LAN tunnel.

I have "Tunnel Everything" configured for my remote users. When I perform a trace route (as a remote user) to a server located at head office, the packet is sent to the 3005's default gateway and not through the established LAN-to-LAN tunnel. My current setting for "Tunnel Default Gateway" is 0.0.0.0. Is this an issue?

The 3005 will not allow me to enter its own private IP address as a Tunnel Default Gateway. In a normal setup, I understand a downstream router or firewall would be the Tunnel Default Gateway. But I only have the 3005 at the remote office, it is the default gateway for the branch office LAN.

Is my traffic flow possible using a single 3005 - can a client who has created a remote access tunnel, then go through a LAN-to-LAN tunnel? (in the same 3005 VPN device) Please advise.

cheers,

Nick Mackovski

[afakhan · Accepted solution]

Hi,

Please make sure that you are Not using 3.6.7(A or B or C), you can use 3.6.7Rel though, or D rev., above OS have issue that prevents that.

0.0.0.0 setting is ok, make sure that override checkbox is not checked, and then configure your L2Ls to include the Pool of IPs that you are assigning to the vpn clients, and same thing on the headend device(symmetrical crypto ACLs or Network List), you dont need a route to do that.

Thx

Afaq

[nmackovski]

Afaq,

Thanks for the quick response to my question.

I was able to locate the bug id for this problem. Bug id is CSCea41973.

I upgraded the 3005 to 3.6(7)D and my issue has been resolved. Thanks for your assistance.

cheers,

Nick