[SOLVED] Hub and Spoke with IKE Mobile

dcdefiore

Hello, I can't seem to get an IPsec tunnel up between my hub and a spoke using the IPsec mobile subnet. Here is information/config

Main Office (Hub)
192.168.1.0/24 (LAN SUBNET)
192.168.253.0/24 (IPsec mobile client Virtual Address Pool)

Spoke 1
10.5.1.0/24 (LAN SUBNET)

Spoke 2
10.20.1.0/24 (LAN SUBNET)

Now - I've been able to successfully connect Spoke 1 and Spoke 2 through the hub (I don't actually need this, was only a test)
Trying the same configuration except changing the IP addresses in scheme with the Mobile Client address pool leads to the Phase 2 between the Hub and Spoke 2 to never come up.
http://i.imgur.com/Cf2Mr9Y.png

dcdefiore

I was able to get it to work by doing the following (for any future readers). I have Windows 10 and wanted to use the built-in VPN for a number of reasons (VPN before logon, ease for users, etc)

My pfSense mobile client is set up a EAP-RADIUS. I created a Powershell script:

Add-VpnConnection -Name "VPN NAME" -ServerAddress xxx.xxx.xxx.xxx -AllUserConnection $true -SplitTunneling $true -AuthenticationMethod MSChapv2 -TunnelType Automatic -EncryptionLevel Required -PassThru
Add-VpnConnectionRoute -ConnectionName "VPN NAME" -DestinationPrefix 10.20.1.0/24
Add-VpnConnectionRoute -ConnectionName "VPN NAME" -DestinationPrefix 192.168.1.0/24

You need to Add-VpnConnectionRoute for any of the subnets that you will access over the VPN.