RV345 Site to Site Routing Issue

[Chronos292]

Hi All

I have an issue with some RV345 I hope you can help with (Hub and Spoke set up);

Site A has an RV345 with an IPSEC  VPN to AWS on WAN1 and an IPSEC VPN to Site B on WAN2

Site A Can see AWS and vice versa, site B can see Site A and vice versa

Site B cannot however cannot access the AWS VPN Via Site A's RV345.

We have tried adding static routes (There is no option to use the VPN as a static route, and configuring it for the WAN interfaces doesn't work). With the VPN set up there is only an option to list one local IP range.

Any help would be appreciated.

[balaji.bandi]

Personally RV series can not be like a DMVPN kind of setup.

you can have dual VPN Stie to site vpn different sites.

make sure if they are not overlapped, you need to allow each other IP address allowed in the tunnel to access. (i am think technical - not sure how feasible in terms of config)

[Chronos292]

Hi

They are not overlapped - all sites are on different internal IP addresses - We cannot find any way of giving each subnet access to the other VPN's

[Spooster IT Services]

@Chronos292 Is there any specific reason to send traffic from Site B to AWS Via Site A? How about if you set up a new VPN between Site B and AWS?

[Chronos292]

We did try this however Site B is on a shared  internal network link, not a public facing IP so we cannot do it that way.

[Spooster IT Services · Accepted solution]

Hello @Chronos292,

This is an unsupported feature. Please find the link below to a long discussion on the same topic.

RV345P - multiple subnets in site-to-site VPN - Cisco Community

*** If you find this information useful, please remember to mark it as "helpful"

[Chronos292]

Many thanks, do you know if the RV 260 supports this at all?

[Spooster IT Services]

@Chronos292 

RV 260 has the same limitation as well.

However, there is an option to define Groups on these hardwares but I strongly recommend not use them as they are full of flaws on routers.

[Chronos292]

Thanks, we did try the groups and it pretty much killed everything.

Thank you for your assistance.

[nagrajk1969]

Hi Chronos92

Don't loose heart so quickly...who says its not possible to configure a Hub-Spoke VPN topology on RV345/RV340/RV260/RV160?????

Its quite doable....provided ofcourse the unknown here is that the AWS VPN-Gw should support this config below

Note: The below method of configuring the Local/Remote subnets for each S2S tunnel mentioned is actually standard (RFC standard) method of configuring Hub-n-Spoke...

Some Assumptions:

We will assume for our sample config that

1. The local-subnet behind SiteA-Gw is 192.168.1.0/24

2. The local-subnet behind SiteB-Gw is 192.168.2.0/24

3. The local-subnet behind AWS-Gw is 192.168.3.0/24

and 

4. Its decided that SiteA will be the HUB gw,

so configure the S2S tunnels as below

A) On SiteA-Gw: Configure the 2 S2S tunnels to SiteB-Gw and AWS-Gw

First Tunnel:
---------------------------------
Name: SiteA_SiteB_Tunnel1:
Remote-Endpoint: SiteB-wan-ipaddress

Note:
- In case as you mentioned SiteB is behind a NAT-router, then all traffic has to be first initiated from SiteB for the tunnel to come up
- so here for "Remote Endpoint, use the setting "dynamic-ip", in which case SiteA-Gw will always be a passive-Gw and responder-only ipsec-peer

Local-ID-Type: FQDN
Enter-value: hubgw.local.net

Local-IP-Type: ANY

Remote-ID: Type: FQDN
Enter-value: siteB.local.net

Remote-IP-Type: Subnet
value: 192.168.2.0/255.255.255.0

- In the Advanced page, just enable DPD and set it to "30s, 120s and clear"
-----------------------------------------------------------------------------

Second Tunnel:
---------------------------------
Name: SiteA_AWS_Tunnel2:
Remote-Endpoint: AWS-wan-ipaddress

Local-ID-Type: FQDN
Enter-value: hubgw.local.net

Local-IP-Type: ANY

Remote-ID: Type: FQDN
Enter-value: AWS.local.net

Remote-IP-Type: Subnet
value: 192.168.3.0/255.255.255.0

- In the Advanced page, just enable DPD and set it to "30s, 120s and clear"
-----------------------------------------------------------------------------

B) On SiteB-Gw: Configure the S2S tunnels to SiteA-Gw

---------------------------------
Name: SiteB_SiteA_Tunnel1:
Remote-Endpoint: SiteA-wan-ipaddress

Note:
- Here since this is behind a NAT-Router...so it will always have to bringup the ipsec tunnel to SiteA
- So in the Advance settings enable "Keepalive" too

Local-ID-Type: FQDN
Enter-value: siteB.local.net

Local-IP-Type: Subnet
value: 192.168.2.0/255.255.255.0

Remote-ID: Type: FQDN
Enter-value: hubgw.local.net

Remote-IP-Type: ANY

- Also In the Advanced page, just enable DPD and set it to "30s, 120s and clear"
-----------------------------------------------------------------------------

C) On AWS-Gw: Configure the S2S tunnels to SiteA-Gw

---------------------------------
Name: AWS_SiteA_Tunnel1:
Remote-Endpoint: SiteA-wan-ipaddress

Although it will be very different, a config similar or corresponding to below settings/value should be applied on AWS-GW

Local-ID-Type: FQDN
Enter-value: AWS.local.net

Local-IP-Type: Subnet
value: 192.168.3.0/255.255.255.0

Remote-ID: Type: FQDN
Enter-value: hubgw.local.net

Remote-IP-Type: ANY

- Also In the Advanced page, just enable DPD and set it to "30s, 120s and clear"
-----------------------------------------------------------------------------

Thats it your Hub-spoke topology with "spoke-to-spoke traffic via Hub" is ready...With this setup/config applied:

- All traffic between SiteB to AWS will now flow via Hub-Gw SiteA in the IPsec tunnels that are established

- The same is true for all traffic flowing from AWS networks to SiteB network..it will be via HubGw
- And ofcourse once the tunnels are UP, the traffic from SiteA networks to SiteB-networks and AWS-networks will also flow thru the tunnels

- Preferably always try to use IKEv2-based tunnels