I have remote access to a Cisco 2821 Router with a security firmware license in California with an IPSec tunnel going to a site in New York. On the New York side, there is a RFC 1918 IP scheme of 10.0.0.0/8. The LA side is 172.17.0.0/16. On the router, there is a VPN which hands out IP's by this command:
ip local pool Pool-1 192.168.50.1 192.168.50.30*
The issue is that, when I (or any other client) connects to the VPN on a remote computer, they are given an IP address (as seen below) but are still not able to contact the 10.0.0.0/8 network. They can still access the local network and the internet, but I'm not sure that access to the internet is going through the VPN. It may be going through their normal home connection.
- The first thing I did was look at the routing table. It had no routes for the 192.168.50.0/24 subnet, so I added some. I added the same route as the 172.17.0.0/16 network since they had access, however this did not work.
- After that, I imagined I should have put an ACL in place to allow 192.168.50.0/24 traffic. I edited the existing ACLs to no avail.
When all said and done, the IP address of the VPN clients is originating within the router and is all virtual. My question is to what interface would I apply an ACL as to allow 192.168.50.0/24 traffic?
- I had a coworker VPN into it as well and he was not able to ping my 192.168.50.29 address.
- The actual IP schemes are far more complex, but for sanity's sake, I've made them nice and easy without VLSM.
- When I (or another client) connect to the VPN, there is a dynamic CRYPTO MAP policy added with an ACL that allows all incoming traffic to the IP, but nothing showing what it's allowed to go to...