topic Re: Clients from another LAN can't reach server from another LAN in General Topics

Clients from another LAN can't reach server from another LAN

Theo — Sat, 05 Jan 2019 00:37:43 GMT

I have a question about Site-Site VPN, and my concern is that the client computers from LAN_A could not access the server from LAN_B (RDP protocol).

VPN Community

Type: Star

Name: Asia

Center Gateways: fw-HongKong

Satellite Gateways: fw-Indonesia (LAN_A) and fw-Malaysia (LAN_B)

VPN Routing- To center and to other satellites through center

fw-HongKong

Gateway: Checkpoint 2200

Version: R77.30 Build 204

fw-Indonesia

Gateway: Checkpoint 1450

Version: R77.20

fw-Malaysia

Gateway: Checkpoint 1100

Version: R77.20

Keep in mind that above gateways are also a satellite gateways of another VPN Community (Star) which is Global. Upon checking the SmartLog, I noticed that the traffic is trying to encrypt in HQ gateway which is part of the Global Community, and is being dropped. I want to know how the traffic can be routed to the Center gateway in Asia (which is fw-HongKong) and reach the server in LAN_B which is behind fw-Malaysia gateway.

I already added the required rule in the destination Policy but it still failing, I guess the traffic is routed to the Center gateways in Global Community? Any ideas what to check?

Thanks for the time in reading from a newbie

Re: Clients from another LAN can't reach server from another LAN

Chris_Atkinson — Sat, 05 Jan 2019 01:49:50 GMT

How specific are the encryption domains configured for each gateway, do they overlap at all?

Is NAT enabled or disabled in each community, note more advanced configuration of the VPN routing is possible if required using vpn_route.conf.

Re: Clients from another LAN can't reach server from another LAN

Theo — Sat, 05 Jan 2019 02:03:20 GMT

note more advanced configuration of the VPN routing is possible if required using vpn_route.conf.

can the traffic be routed to another satellite gateway by configuring vpn_route.conf? can you please give a hint to force it? i mean is it possible that the traffic from fw-Indonesia can reach the server in fw-Malaysia by passing the Center gateway fw-HongKong?

Re: Clients from another LAN can't reach server from another LAN

Chris_Atkinson — Sat, 05 Jan 2019 02:42:20 GMT

Example:

Domain Based VPN

Re: Clients from another LAN can't reach server from another LAN

Theo — Sun, 06 Jan 2019 13:25:17 GMT

I got this, and thank. I was able to update the $FWDIR/conf/vpn_route.conf in the Security Management Server

I just noticed from the SmartLog, the traffic is trying to Encrypt to Global Community instead of Asia VPN Community. I want the traffic to be Encrypt/Decrypt in my Center Gateway which is fw-HongKong

Re: Clients from another LAN can't reach server from another LAN

Theo — Fri, 11 Jan 2019 02:24:25 GMT

Any idea guys?

Re: Clients from another LAN can't reach server from another LAN

Chris_Atkinson — Fri, 11 Jan 2019 02:36:51 GMT

As above I would also check that your VPN Domains are configured specific enough to avoid overlaps. You may have to leverage the "manual" option to achieve.