IPSEC with 3 sites and routing between them

cr_hyland

Hi,

I have 3 sites A, B and C
Site A is the primary site and Site B / Site C are branch offices.

There are IPSEC tunnels between A and B and between A and C and all works well.

I need to be able to route traffic between B and C through A but I cant seem to be able to to this with static routes.

Has anyone achieved this and could you give some pointers?

Thanks.

kitdavis

I just dealt with something rather similar.

Look for the tutorial on how to send all traffic to the internet via a VPN connection. Using those directions create a second phase 2 connection between A and B that uses C's subnet and between A and C that uses B's subnet. You will also have to create manual outbound routing information for those connections.

Of course the easiest approach would be to build a tunnel directly between B and C.

cr_hyland

That for that but I had already tried adding a second phase 2 before i hit the forums.

Problem is that when i add the second phase 2 to site A it doesn't seem to recognize the site C subnet and won't allow me to connect the VPN. I get no little arrow to connect it.

Is there a way around this that you know of?

Cheers.

cr_hyland

Anyone any idea why i can't add a second Phase 2 for Site B and C?

cr_hyland

I've tried everything I can think of but no way can I get this to work.
no matter what I do I cant get a second phase 2 to come up when it uses a subnet that doesn't directly exist on a wan or lan interface.

is this a bug in pfsense 2.1 or am I doing something stupid?

please can someone help, I really need to get this working.

corradolab

Hi craggy,

just curious why you cant create an IPSec tunnel between B and C.
Can you explain?

MLIT

@craggy:

I've tried everything I can think of but no way can I get this to work.
no matter what I do I cant get a second phase 2 to come up when it uses a subnet that doesn't directly exist on a wan or lan interface.

is this a bug in pfsense 2.1 or am I doing something stupid?

please can someone help, I really need to get this working.

Another way to do this would be to use a larger subnet on the first Phase 1 of the WAN.

I.E.

You have 3 networks:

192.168.100.0/24 A
192.168.101.0/24 B
192.168.102.0/24 C

So when you setup the phase 2 for A to B, on the B side you set the remote WAN to 192.168.0.0/16