I have a network that is comprised of a main office and multiple branch offices.

The main office houses the servers and each branch office has an IPsec tunnel to the main office. There are no tunnels between the branch offices directly. So Branch Office 1 and Branch Office 2 can communicate with Main Office but not directly with each other.

Without changing any configurations on the routers at any location would it be possible for computers at the branch offices to communicate with each other by routing their traffic through the Main Office somehow?

  • 1
    configs please.
    – dk1
    Jul 29, 2015 at 2:11
  • Yes, please provide device models and configurations. It may be a simple thing to do, but, at this point, we are merely guessing.
    – Ron Maupin
    Mar 9, 2016 at 21:31
  • Why don't you consider NHRP protocol? Jul 20, 2016 at 6:50
  • Is it not possible to attempt to ping from one branch to the other? Aug 20, 2016 at 3:36
  • Did any of the answers help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively you can answer your own question and accept the answer.
    – Ron Maupin
    Aug 6, 2017 at 4:18

2 Answers 2


Weirdly enough I just answered a similar question here: https://unix.stackexchange.com/questions/269909/ipsec-rightsubnet-to-wide-cannot-override-routing-table-ipsec-route-some-pack?atw=1

I will answer similarly: what you're doing is VPN concentration. There are various vendor-specific ways to do this, some very straightforward, some extremely esoteric, but my recommendation is to avoid ALL that and configure your network from a layer 3 level, with IPsec doing lower level connection glue.

Specifically in your case, you'd create IPsec links between the branch office and the main office but instead of specifying each office's subnets directly in the IPsec config, you'd create /30 point-to-point links between them, then use GRE on top of that to either statically point subnets to each link, or (far better) use OSPF to redistribute your routes.

Point to point links with routing logic is far more scalable versus a bunch of static routes with directly connected subnets. In the latter (which you're currently using) you have to constantly reconfigure IPsec to be aware of what can route where, even when you're adding one subnet. As you add more than one subnet, the complexity grows exponentially and quickly becomes untenable. Add in firewall / security policies and security planes at various points and you've quickly got a huge glut of configuration on your hands.

Point to point links will completely remove the complexity, because routing now lies in the typical routing spots: static tables, or dynamic routing protocols like OSPF and BGP. If you leverage OSPF and BGP you will never have to add routes throughout your network; you simply add a subnet and the route will propagate automatically throughout all the offices. Also your security will be straightforward, as you can now place security planes in logical places, rather than working out where they sort of fit in IPsec-land.

This will most likely require a weekend overhaul of your remote office configurations to the main office. However once this is in place, future changes and adjustments will be extremely straightforward; in your current config, any change will require a number of manual ripple changes throughout the network, and the complexity will introduce errors.

  • I agree with the logic. It's worth nothing that, if the equipments support it, IPSEC Virtual Tunnel Interface may be of great help.
    – JFL
    Apr 21, 2016 at 6:47

Totally possible, comes down to a couple of things, (i set this up regularly).

If its not already happening (im guessing not) you have either:

a) a nat problem where branch A router is configured to only exclude current branch and HO subnets, thus traffic to other branches is trying to go via wan or just getting mangled in nat.

b) an access list/firewall issue where the traffic has a path and is being denied by a device.

c) a routing issue where the branch A has no path to branch B via any gateway that it has - which you can normally fix with static routing if need be.

Typically these are the problems you face with vpns and hub-spoke vpns.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.