VPN Client

[p.holley]

I have the following setup:

vpnclient------>FW1<-----vpn tunnel------->FW2

When the tunnel is down, and a vpnclient on the inside network of FW1 establishes a vpn sesion with FW2. The vpnclient connection is connected, but the vpnclient cannot ping the inside network of FW2.

If I take FW1 out of the equation and connect the vpnclient directly to the internet connection. The vpnclient is connected, and I can ping the inside ip address of FW2.

What could I be missing in my config on FW1 or FW2?

[r.fang]

I ran into same scenario before.

both vpnclient and Fw1 have same IPsec tunnel peer IP , which is outside IP of FW2.

When VPN tunnel is up between FW1 and FW2. vpnclient could not neogatiate Tunnel with FW2 anymore, this is vpnclient IPsec tunnel within another Ipsec tunnel( tunnel bwt FWs). FW2 confused.

[p.holley]

Thanks. Is there no work around for this scenario? Just wandering

In your case, was the vpnclient on FW1 inside network able to reach the inside network of FW2 when the tunnel is up between FW1 and FW2

[andy-cole]

Just to be clear on this, is the VPN tunnel from vpnclient 1 to FW2? If so then does FW1 run NAT?

If this is the case you will need to use NAT-T, otherwise the tunnel comes up but wont pass any data.

Andy