Topic: IPSEC Question's

[Greg]

I have 3 offices A, B and C running IPSEC on 5.5 boxes. I can see LAN B and C (Clients), from LAN A (server) and I can see LAN A from LAN B and C but can't see LAN B from C or visa versa.
I tried setting up IPSEC between B and C but it takes down the other tunnels.

Also I still can't browse a web page on LAN B or C from A, I can scan port 80 from A on B and see it and I can VNC into a system on LAN C and browse on LAN C from there.


Any Ideas

[Michael Smith]

I posted the question you're answering just a short while ago ... I was wondering what would happen if you put up a link between each of the three nodes ... it takes everything down, huh?  not too surprising I guess.  the packets go 'round & round ... as for "browsing a webpage" what do you mean?  if you're trying to browse by NetBIOS name that's a real tricky thing that I haven't worked out.

There must be a way to use A to route packets from B to C and vice versa ... any gurus care to lend enlightenment?

[Greg]

By browsing I mean HTTP I have a web server at each location. I can scan port 80 and see it, I can telnet to anything on Net B or C from A, I can VNC to anything  but can't use a browser I get no responce its like something is not passing the request back.
I did not install Server A so can Squid be part of the problem this is what I get if I telnet to port 80 on Net C from Net A and then break out of the lockup/no responce.

HTTP/1.0 400 Bad Request
Server: Squid/2.4.STABLE3
Mime-Version: 1.0
Date: Thu, 07 Aug 2003 11:21:23 GMT
Content-Type: text/html
Content-Length: 865
Expires: Thu, 07 Aug 2003 11:21:23 GMT
X-Squid-Error: ERR_INVALID_REQ 0
X-Cache: MISS from 1375.BlaBla.com
Proxy-Connection: close

ERROR

 

The requested URL could not be retrieved

While trying to process the request:

  \ 

The following error was encountered:

• 
  Invalid Request
  
  

 Some as pect of the HTTP Request is invalid.  Possible problems:

• Missing or unknown request method
  
• Missing URL
  
• Missing HTTP Identifier (HTTP/1.0)
  
• Request is too large
  
• Content-Length missing for POST or PUT requests
  
• Illegal character in hostname; underscores are not allowed
  

Your cache administrator is
admin@BlaBla.com.

Generated Thu, 07 Aug 2003 11:21:23 GMT by 1375.BlaBla.com (Squid/2.4.STABLE3)

Connection to host lost.

[Greg]

If I stop Squid I get this

telnet 192.168.20.66 80
Connecting To 192.168.20.66...Could not open connection to the host, on port 80: Connect failed

But then no one on Lan A can browse the web.

[Hazen Valliant-Saunders]

This is a forward route issue on Lan A?
You need to have both forward and reverse routes enabled at each location
IE
Lan     Routing INCL GW
A        BC                 VPNA VPNC
B        AC                 VPNA VPNC
C        AB                 VPNA VPNB

Hence packets may transparently go round and round, I've had the same issue but with cisco hardware.

HTH
Hazen.

[Steve Bush]

I have 6 SME servers fully meshed using freeswan.  Each server has 5 IPSEC links setup to the other servers.  I can access all IP addresses from any of the networks with no problems.  You should be able to setup a link between lan B and C, which should be the easiest solution to your problem.

[Steve Bush]

I have 6 SME servers fully meshed using freeswan.  Each server has 5 IPSEC links setup to the other servers.  I can access all IP addresses from any of the networks with no problems.  You should be able to setup a link between lan B and C, which should be the easiest solution to your problem.

[Greg]

Are you running 5.5 or 6.0?
If just I set the Local Networks on Server B to Server C or on Server C to Server B it stops routing on that server nothing in or out. Cant SSH or Telnet to it.

[Steve Bush]

I have a mixture from 5.12 to 5.6.  (5.12 will be gone shortly)

So you add a local network, with a blank default route and the external interface stops routing?   I'm assuming the subnets aren't overlapping.

[Greg]

A is 192.168.1 B is 192.168.20 and C is 192.168.40
As soon as I as I add the local network of C to B
Network address 192.168.40.0
Subnet Mask 255.255.255.0
Router 192.168.20.1
B stops routing

Am I missing something?

[Steve Bush]

I don't know if this is the problem,
But you should leave the router entry blank to use the default route.

[Greg]

Just tried that and it locks up just the same.