1

Could you tell me if my assumptions are correct and what happens in the last scenario?

Say I am trying to ping an 192.168.x.x. address:

Scenario 1:

If my local network is 192.168.x.x, then IPsec tunnels or not the packet will look locally.

Scenario 2:

If my local network is 10.x.x.x, and my IPsec tunnel local network is 192.168.x.x, then the packet will go there.

Scenario 3:

If my local network is 10.x.x.x, and there are multiple IPsec tunnels to different networks, what does the behavior look like? Do tunnels have priority?

Improve this question
3
  • I think more than the tunnel, it'll depend upon the IP address, which one matches to the best rather than tunnel priority. Also, if you don't mind me asking, where would a situation come to play wherein you require so many tunnels?
    – Izy-
    Jul 1, 2016 at 4:41
  • I am not sure how practical this is or if any sane IT group would do this. I am just working with ipsec and tunnels and have had some connectivity problems due to the address spaces and was curious
    – mccormickt12
    Jul 7, 2016 at 19:53
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 14, 2017 at 18:29

2 Answers 2

Reset to default
1

If an IP address to which you are sending traffic is on a different network, it will be switched or dropped by a router based on the router's routing table.

If the router has a path to the destination network (a default route counts as the most general path, if you have one, but the router will take the most specific path it has), the router will switch the traffic to the router interface in the path toward the destination.

If a router doesn't have a path for the destination network, it will drop the traffic.

Your question doesn't have enough information to specifically tell you what will happen in scenarios 2 and 3.

Improve this answer
0

With the limited information offered on your environment...Ive seen something similar at one of my previous positions. We had IPsec tunnels setup in a hub and spoke format coming from all of the companies airports with the traffic travelling into the data center first and then travelling into the interior of our network. That is a simple summary...ASR>ASA>5K>checkpoint firewalls for HQ>Cisco 3850 campus switches stack of 8.

That was ours primarily although we had two data centers and all traffic in a hub and spoke setup IPSEC tunnel setup funnels through the data Cisco ASR routers>Core switches>ASA>Checkpoint firewalls>campus level switches etc etc atleast that was our design when I was employed with the airlines =).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.