Ipsec link routes from one office but not the other?

Morgenstein

Been pulling my hair out - going bald anyway…

But here is my issue.

I have two offices that I am trying to link together. I'm able to get the link up, and from one office i can see the other office but I can not do it reverse... Example:

office 1 - 192.168.100.0/24
office 2 - 10.0.0.0/24

From Office 2, I can see and communicate with Office 1.
From Office 1, I am unable to see or communicate with Office 2.

I set all the nat rules the same on both sides - the only thing different is phase 2 on the configs which is to handle the different IP ranges. Any clues or what other info would be helpful to investigate?

thnkx.
-Morgen

Morgenstein

quick update:
I have changed nothing…..

however,
From Office 1, I'm now able to see the web interface of pfsense of Office 2. I can even ping it too, but I can not go past pfsense.

i have validated that firewall--rules does have an entry in ipsec to allow all on both sides.

-Morgen

Morgenstein

ugg…
resolved it... ap isolation was on . I have a wireless router behind my pfsense as everything is wireless at the other office.. killed ap isolation and i can now get to all the systems behind it.

hope this helps someone else. :)
-Morgen

kejianshi

Yes - I learned not to use AP isolation.