IPsec tunnel configuration question

Question

I have a network that is comprised of a main office and multiple branch offices.

The main office houses the servers and each branch office has an IPsec tunnel to the main office. There are no tunnels between the branch offices directly. So Branch Office 1 and Branch Office 2 can communicate with Main Office but not directly with each other.

Without changing any configurations on the routers at any location would it be possible for computers at the branch offices to communicate with each other by routing their traffic through the Main Office somehow?

Answer 1

Weirdly enough I just answered a similar question here: https://unix.stackexchange.com/questions/269909/ipsec-rightsubnet-to-wide-cannot-override-routing-table-ipsec-route-some-pack?atw=1

I will answer similarly: what you're doing is VPN concentration. There are various vendor-specific ways to do this, some very straightforward, some extremely esoteric, but my recommendation is to avoid ALL that and configure your network from a layer 3 level, with IPsec doing lower level connection glue.

Specifically in your case, you'd create IPsec links between the branch office and the main office but instead of specifying each office's subnets directly in the IPsec config, you'd create /30 point-to-point links between them, then use GRE on top of that to either statically point subnets to each link, or (far better) use OSPF to redistribute your routes.

Point to point links with routing logic is far more scalable versus a bunch of static routes with directly connected subnets. In the latter (which you're currently using) you have to constantly reconfigure IPsec to be aware of what can route where, even when you're adding one subnet. As you add more than one subnet, the complexity grows exponentially and quickly becomes untenable. Add in firewall / security policies and security planes at various points and you've quickly got a huge glut of configuration on your hands.

Point to point links will completely remove the complexity, because routing now lies in the typical routing spots: static tables, or dynamic routing protocols like OSPF and BGP. If you leverage OSPF and BGP you will never have to add routes throughout your network; you simply add a subnet and the route will propagate automatically throughout all the offices. Also your security will be straightforward, as you can now place security planes in logical places, rather than working out where they sort of fit in IPsec-land.

This will most likely require a weekend overhaul of your remote office configurations to the main office. However once this is in place, future changes and adjustments will be extremely straightforward; in your current config, any change will require a number of manual ripple changes throughout the network, and the complexity will introduce errors.

Answer 2

Totally possible, comes down to a couple of things, (i set this up regularly).

If its not already happening (im guessing not) you have either:

a) a nat problem where branch A router is configured to only exclude current branch and HO subnets, thus traffic to other branches is trying to go via wan or just getting mangled in nat.

b) an access list/firewall issue where the traffic has a path and is being denied by a device.

c) a routing issue where the branch A has no path to branch B via any gateway that it has - which you can normally fix with static routing if need be.

Typically these are the problems you face with vpns and hub-spoke vpns.

Cheers,