09-27-2018 09:37 AM
Currently Im labing a situtation where I'll need to have branch users route to a vendor through HQ via IPsec tunnels. Users at my banch access can acesss Web/HQ services though the HQ firewall, but when accessing the vendor. Logs show from HQ the attempts to the vendor from the branch office. But nothing but incompletes/aged-out.
From HQ, I do see active connections for phaseII for the branch/vendor connection but of course no encap/decaps.
Also I do have redistrabution profiles for Branch and Vendor connections on the HQ firewall.
Thoughts?
09-27-2018 09:50 AM
Just found this, which Im spot on. I do worry that my vendor side might be incorrect
10-05-2018 10:09 AM
So found I the problem, or "more of a design issue".
The dynamic vpn setup on my branch side, is the issue to the vendor. I relized that when settting up a direct connection from branch to vendor. The vendor does not support Nat-T!!!! Doh!!!! Which is why I would see the out bound encaps but no decaps back on the HQ side.
Back to the drawing board... Hopefully this stops someone form spinning their wheels
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
