Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    VPN Site to site IPSEC

    Scheduled Pinned Locked Moved IPsec
    13 Posts 3 Posters 1.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      rayx
      last edited by

      Hello, I want to make a IPSEC connection site-to-site between 4 sites with IPSEC, and I want the 4 sites to see each other.
      At the moment, the site to site tunnel with the server and the other sites works correctly, but the B, C and D sites can not be seen between them.

      My question is, on the server side, should I add 3 VPN servers?
      or do it in phase 2?
      Or create 1 alone and configure it in some predefined way?

      And on the client side, how do I see / configure the other sites?

      All have a range:
      10.1.0.0/16 - HEADER A - Server
      10.2.0.0/16 - HEADQUARTERS B
      10.3.0.0/16 - HEADQUARTERS C
      10.4.0.0/16 - HEADING D

      1 Reply Last reply Reply Quote 0
      • NogBadTheBadN
        NogBadTheBad
        last edited by

        Wouldn't you create IPsec tunnels on all the routers going to all the other routers then run FFR to look after the routing ?

        Andy

        1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          Because the routing table has no effect on IPsec so FRR won't do you any good there.

          You want to do it in your Phase 2s.

          If a network should be reachable from a site, there should be a Phase 2 for it.

          For instance, For the tunnels from A to B:

          On A:
          Local Network: 10.1.0.0/16, Remote Network: 10.2.0.0/16
          Local Network: 10.3.0.0/16, Remote Network: 10.2.0.0/16
          Local Network: 10.4.0.0/16, Remote Network: 10.2.0.0/16

          On B:
          Local Network: 10.2.0.0/16, Remote Network: 10.1.0.0/16
          Local Network: 10.2.0.0/16, Remote Network: 10.3.0.0/16
          Local Network: 10.2.0.0/16, Remote Network: 10.4.0.0/16

          Etc.

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • R
            rayx
            last edited by

            and if I only have an ipsec connection between headquarters A and D
            but in the headquarters D I want to see the headquarters B
            all other venues are configured and seen with WIMAX
            how do I pass the routing table?

            attached network image

            ![Sin título.png](/public/imported_attachments/1/Sin título.png)
            ![Sin título.png_thumb](/public/imported_attachments/1/Sin título.png_thumb)

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              and if I only have an ipsec connection between headquarters A and D
              but in the headquarters D I want to see the headquarters B
              all other venues are configured and seen with WIMAX
              how do I pass the routing table?

              You put the local and remote networks on that tunnel.

              On the tunnel between A and D you would make a P2 for D to B.

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • R
                rayx
                last edited by

                @Derelict:

                and if I only have an ipsec connection between headquarters A and D
                but in the headquarters D I want to see the headquarters B
                all other venues are configured and seen with WIMAX
                how do I pass the routing table?

                You put the local and remote networks on that tunnel.

                On the tunnel between A and D you would make a P2 for D to B.

                I do not understand you

                ![Sin título.png](/public/imported_attachments/1/Sin título.png)
                ![Sin título.png_thumb](/public/imported_attachments/1/Sin título.png_thumb)

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  If you are going to refer to sites as A, B, C, and D it would be helpful to have that information on your diagram.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • R
                    rayx
                    last edited by

                    hello, I modified the scheme
                    I have added the HEADQUARTERS E
                    This is really my topography
                    I currently have a vpn Ipsec between the HEADQUARTERS A and E
                    all other HEADQUARTERS , except E, are communicated by WIMAX
                    I want to pass the routing table to E headquarters, from the others HEADQUARTERS so I can see them all

                    ![Sin título.png](/public/imported_attachments/1/Sin título.png)
                    ![Sin título.png_thumb](/public/imported_attachments/1/Sin título.png_thumb)

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      So you already have a Phase 2 entry on the VPN for this:

                      10.1.0.0/16 <-> 10.5.0.0/16

                      Make 3 more:

                      10.2.0.0/16 <-> 10.5.0.0/16
                      10.3.0.0/16 <-> 10.5.0.0/16
                      10.4.0.0/16 <-> 10.5.0.0/16

                      Obviously with the reciprocal entries at Site E.

                      Add routes to sites B, C, and D those sites for 10.5.0.0/16 with a gateway of whatever they talk to at site A.

                      Make sure all necessary firewall rules pass the desired traffic.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • R
                        rayx
                        last edited by

                        and how do I do this without leaving the connection by wimax with the others HEADQUARTERS ?

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          What?

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • R
                            rayx
                            last edited by

                            if I configure this in VPN tunnel,in both extremes

                            10.1.0.0/16 <-> 10.5.0.0/16

                            Make 3 more:

                            10.2.0.0/16 <-> 10.5.0.0/16
                            10.3.0.0/16 <-> 10.5.0.0/16
                            10.4.0.0/16 <-> 10.5.0.0/16

                            I lose communication by wimax between headquarters
                            A-D
                            A-B
                            A-C
                            ….....

                            I do not know if I explain

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              No you don't.

                              10.2.0.0/16 <-> 10.5.0.0/16 is not the same thing as 10.2.0.0/16 <-> 10.1.0.0/16

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.