Hub and Spoke help

3vian

I'm trying to get a hub and spoke network working for three sites. At this stage a mesh network is not possible.

Let's call them Remote A, Remote B and HQ. At the moment HQ is connected to RA and RB, but I can't get traffic between RA and RB (as expected), but my understanding is that a second Phase 2 could solve the problem.

FYI RA and HQ are both running 2.1.5, while RB is using a Cisco ASA 5505. The Cisco 5505 doesn't support FQDNs which is why a mesh network won't work as RA has a dynamic IP. Hopefully the Cisco ASA 5505 won't be a blocking point. The Cisco box will be replaced with PFSense shortly, but I will still want to get hub and spoke working for other reasons.

I'm just not sure what subnets to put in the Phase 2 setups. I looked around the forum and there is a mention of such a setup, but it isn't clear to me.

Any help would be greatly appreciated.

@ggiants81:

Hi there.
Is it possible for Pfsense to for instance have two ipsec tunnels , like A and B where A remote network is 10.10.10.0/24 and B remote network is 10.10.11.0/24 so that remote net A can reach remote net B through the IPSEC tunnel to pfsense ? Like a hub and spoke .

jimp

That works fine if you put the right Phase 2 networks on there.

Tunnel to A
P2 for Main to A
P2 for B to A

Tunnel to B
P2 for Main to B
P2 for A to B

And on the other side, the reverse direction of each.

kfm

Hi jimp,

Hope to refresh this thread is OK. I found it by searching and you'll see I'm a newbie.

I apreciated your answer above pointing to the direction to go but unfortunately I failed.

I have the main firewall (fixed public ip) and two "satellites" (natted behind routers) each establishing an ipsec tunnel to main (works fine). Now I would like to enable communication between the satellites.

Main fw:
Phase1 to sat1
Phase2 LAN to sat1 (192.168.10.0/24)
Phase2 sat2 (192.168.20.0/24) to sat1 (192.168.10.0/24)
Phase1 to sat2
Phase2 LAN to sat2 (192.168.20.0/24)
Phase2 sat1 (192.168.10.0/24) to sat1 (192.168.20.0/24)

sat1:
Phase1 to main
Phase2 LAN to main (192.168.30.0/24)
Phase2 LAN to sat2 (192.168.20.0/24)

sat2:
Phase1 to main
Phase2 LAN to main (192.168.30.0/24)
Phase2 LAN to sat1 (192.168.10.0/24)

What is wrong?

Thank you or someone else very much in advance!
Uwe

kfm

Nothing was wrong - it works!

Menu: Status - IPSec: Disconnect/Reconnect have to be used!

Uwe