Missing something on a site to site vpn tunnel

IronComet

Good Afternoon,

I have a company that has three locations and pfsense boxes in all three.
Site A is the main and site B and C have a tunnel set up to go to A but not each other.
It reports that it connects fine. I can ping site A firewall from B and C and can get into one of two servers at Site A fine using RDP.
I can access the firewall gui as well of site A from B and C.

The weird thing is that is happening is that I cant RDP into the second server. I added a static route on the 2008 server to match the tunnel ip but that still did not work. It gets even weirder when I set the tunnel up to go from my office using our PF sense box to Site A. I can connect fine with no additional settings added to the server at Site A.

The only thing I can figure is that it has something to do with ATT which is at all 3 locations. Those routers are supposed to just forward information on but we have had instances where an ipsec tunnel was in place and would drop randomly and all we would have to do to get it back would be to reboot their ATT routers.

ATT of course says nothing is wrong all the time with their equipment so what I am wondering what troubleshooting or capturing can i do within pfsense to either find the problem in pfsense or get enough proof to make ATT look deeper?

Thanks

viragomann

Check if the servers firewall blocks the access from the other site.
Also ensure that the pfSense box running the vpn server is the default gateway on that server.

I don't think that this is an issue of the internet connection, however, pfSense monitors the gateway by default. You may set an alternative IP address for monitoring in the gateway settings (System > Routing > Gateways). Set an IP outside your network, for instance the first hop on the backbone, for monitoring. Ensure that it responses to pings.

IronComet

Thanks.
I will check that out when I can get into their system later today.
It was just strange that I can access that server fine if I set the tunnel up from my office to their site but it does not work if the tunnel is set up from their other two locations to their main one.

viragomann

Another point to check here is if the local and the remote networks overlaps.