ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    Site to site VPN with vLANs

    IT Discussion
    4
    6
    169
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      Jimmy9008
      last edited by

      Hi folks,

      I have a few switch stacks here. vLAN1/default is set to have a gateway of 172.16.0.1, which is an ASA. The box has some site-to-site VPNs setup.

      From the default LAN/vLAN1, I can ping/communicate with devices on the other end of the VPN.

      Interface 5 of the ASA is vLAN10, this is 10.4.0.1. Any device on that network is unable to communicate over the VPN, but the ASA is set to allow this traffic from 10.4.x.x as far as I can see...

      Could it be a vLAN issue? If vLAN10 traffic is going over the VPN, does the other end need to also be set for vLAN10 to allow that on the remote LAN? Or, as its routed, would the vLAN information in the traffic be irreverent from the 10.4.0.1 gateway out?

      Best,
      Jim

      dafyreD 1 Reply Last reply Reply Quote 0
      • dafyreD
        dafyre @Jimmy9008
        last edited by

        @Jimmy9008 said in Site to site VPN with vLANs:

        Hi folks,

        I have a few switch stacks here. vLAN1/default is set to have a gateway of 172.16.0.1, which is an ASA. The box has some site-to-site VPNs setup.

        From the default LAN/vLAN1, I can ping/communicate with devices on the other end of the VPN.

        Interface 5 of the ASA is vLAN10, this is 10.4.0.1. Any device on that network is unable to communicate over the VPN, but the ASA is set to allow this traffic from 10.4.x.x as far as I can see...

        Could it be a vLAN issue? If vLAN10 traffic is going over the VPN, does the other end need to also be set for vLAN10 to allow that on the remote LAN? Or, as its routed, would the vLAN information in the traffic be irreverent from the 10.4.0.1 gateway out?

        Best,
        Jim

        Does the other side of the VPN know how to get back to 10.4.0.0?

        J 1 Reply Last reply Reply Quote 1
        • J
          Jimmy9008 @dafyre
          last edited by

          @dafyre said in Site to site VPN with vLANs:

          @Jimmy9008 said in Site to site VPN with vLANs:

          Hi folks,

          I have a few switch stacks here. vLAN1/default is set to have a gateway of 172.16.0.1, which is an ASA. The box has some site-to-site VPNs setup.

          From the default LAN/vLAN1, I can ping/communicate with devices on the other end of the VPN.

          Interface 5 of the ASA is vLAN10, this is 10.4.0.1. Any device on that network is unable to communicate over the VPN, but the ASA is set to allow this traffic from 10.4.x.x as far as I can see...

          Could it be a vLAN issue? If vLAN10 traffic is going over the VPN, does the other end need to also be set for vLAN10 to allow that on the remote LAN? Or, as its routed, would the vLAN information in the traffic be irreverent from the 10.4.0.1 gateway out?

          Best,
          Jim

          Does the other side of the VPN know how to get back to 10.4.0.0?

          I'll have a look. So, the other end is 10.2.0.1, do I need to add a route in that ASA to say 10.4.x.x -> route out 10.2.x.x?

          dafyreD 1 Reply Last reply Reply Quote 0
          • dafyreD
            dafyre @Jimmy9008
            last edited by

            @Jimmy9008 said in Site to site VPN with vLANs:

            @dafyre said in Site to site VPN with vLANs:

            @Jimmy9008 said in Site to site VPN with vLANs:

            Hi folks,

            I have a few switch stacks here. vLAN1/default is set to have a gateway of 172.16.0.1, which is an ASA. The box has some site-to-site VPNs setup.

            From the default LAN/vLAN1, I can ping/communicate with devices on the other end of the VPN.

            Interface 5 of the ASA is vLAN10, this is 10.4.0.1. Any device on that network is unable to communicate over the VPN, but the ASA is set to allow this traffic from 10.4.x.x as far as I can see...

            Could it be a vLAN issue? If vLAN10 traffic is going over the VPN, does the other end need to also be set for vLAN10 to allow that on the remote LAN? Or, as its routed, would the vLAN information in the traffic be irreverent from the 10.4.0.1 gateway out?

            Best,
            Jim

            Does the other side of the VPN know how to get back to 10.4.0.0?

            I'll have a look. So, the other end is 10.2.0.1, do I need to add a route in that ASA to say 10.4.x.x -> route out 10.2.x.x?

            Yeah, that'd be a good starting point. Just remember that you gotta do the opposite on the other side... 10.2.x.x -> 10.4.x.x

            1 Reply Last reply Reply Quote 0
            • dbeatoD
              dbeato
              last edited by

              You need to ad the additional network even if VLAN to the Site to Site VPN destination networks. Otherwise having rules will not make a difference.

              1 Reply Last reply Reply Quote 0
              • JaredBuschJ
                JaredBusch
                last edited by

                Correct. You have to have routing to make this work.

                Every router OS implements it differently.

                Hell the EdgeRouter does it multiple ways if you need to.

                A basic IPSEC tunnel where you simply specify the local and remote subnet, one pair per tunnel (each IPSEC connection can have more than one tunnel pair). Or a more advanced vti interface where you put in specific routes.

                1 Reply Last reply Reply Quote 1
                • 1 / 1
                • First post
                  Last post