Layer 2 network over VPN

Is it possible to extend the subnet (same broadcast domain) across a VPN tunnel? .For example we have 10.1.100.X in VLAN 100 at HQ can we use the same VLAN and same IP range at a remote site on the other side of the VPN tunnel, if so can they forward broadcast traffic?
Siddhartha

You need to look into L2 tunneling (L2TP being possibly the choice, includes L2tp ovet ipsec).
Both SSL and IPsec are L3 solutions, you can share same subnet as a LAN interface but you might have problem with broadcasts depending on your configuration and actual needs.

Similar Messages

Problem accessing an adjacent remote network over VPN (2 asa5505)

Hello all,
I have 2 ASA5505 (CORP and remote) connected via VPN. The remote site contains 2 subnets (192.168.1.0/24 and 192.168.0.0/24 (for remote VPN users)). The corp site has 192.168.2.0/24 directly connected to ASA5505 and an adjacent network connected via another device namely the 172.16.0.0/16 network.
I am able to ping site-to-site between 192.168.0 -> 192.168.2
and
192.168.1 -> 192.168.2
I am unable to ping from remote site to the 172.16 network however.
I added permit ACLs on both my NAT and CRYPTO ACLs. and when I am trying to ping the remote 172.16 network I get the following messages on my CORP ASA:
4 Aug 12 2007 02:59:52 400010 192.168.2.1 192.168.0.10 IDS:2000 ICMP echo reply from 192.168.2.1 to 192.168.0.10 on interface inside
reply is timing out though.
Any tips would be appreciated!
My ACLS:
REMOTE SITE:
#NONAT
access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 172.16.0.0 255.255.0.0
access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.0.0 255.255.0.0
access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.3.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 172.16.0.0 255.255.0.0
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 192.168.1.0 255.255.255.0
#CRYPTO ACL
access-list 100 extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list 100 extended permit ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0
access-list 100 extended permit ip 192.168.1.0 255.255.255.0 172.16.0.0 255.255.0.0
access-list 100 extended permit ip 192.168.0.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list 100 extended permit ip 192.168.0.0 255.255.255.0 192.168.3.0 255.255.255.0
access-list 100 extended permit ip 192.168.0.0 255.255.255.0 172.16.0.0 255.255.0.0
access-list 100 extended permit ip 192.168.1.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list 100 extended permit ip 192.168.0.0 255.255.255.0 192.168.1.0 255.255.255.0
CORP SITE:
#CORP
access-list 200 extended permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
access-list 200 extended permit ip 172.16.0.0 255.255.0.0 192.168.3.0 255.255.255.0
access-list 200 extended permit ip 172.17.0.0 255.255.0.0 192.168.3.0 255.255.255.0
access-list 200 extended permit ip 192.168.2.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list 200 extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list 200 extended permit ip 172.16.0.0 255.255.0.0 192.168.0.0 255.255.255.0
access-list 200 extended permit ip 172.16.0.0 255.255.0.0 192.168.1.0 255.255.255.0
nat (inside) 0 access-list 200
nat (inside) 1 0.0.0.0 0.0.0.0
#CRYPTO ACL
access-list 105 extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list 105 extended permit ip 192.168.2.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list 105 extended permit ip 192.168.3.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list 105 extended permit ip 172.16.0.0 255.255.0.0 192.168.1.0 255.255.255.0
access-list 105 extended permit ip 172.16.0.0 255.255.0.0 192.168.0.0 255.255.255.0
access-list 105 extended permit ip 192.168.3.0 255.255.255.0 192.168.1.0 255.255.255.0
Thanks in advance!

The config looks ok.
If you were trying to ping 172.16.x.x I don't see why the log would be what you displayed. Where are you pinging from, the remote site?
"4 Aug 12 2007 02:59:52 400010 192.168.2.1 192.168.0.10 IDS:2000 ICMP echo reply from 192.168.2.1 to 192.168.0.10 on interface inside"
Does the 172.16 network have a route to the 192.168.0.0 and 192.168.1.0 network?

Duplicate private networks over vpn !

A customer is having the same private network as my company does, but i have to build a vpn between those 2 networks.
Our site has a ASA5510 and the customer has a PIX 515e. How should i do this ?
Many thanks for helping me.
Gerard Schurink

You could inspire yourself with this document
http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a00800949f1.shtml

DNS over VPN

Hi community,
I am having some trouble with dns over vpn. On server side of VPN the dns is working 100% i.e servername.domain.com resolves to local IP address correctly from within network. However, when i connect into network over VPN the dns does not work correctly - it resolves servername correctly but not servername.domain.com. I can overcome this by setting VPN above my Ethernet adaptor in service order but then all my traffic gets routed over VPN connection (which i don't want) - even if I try adding network routing defn on VPN server. I probably need to do something on the VPN client (Snow leopard 10.6.1)?
Please help!

Rather than dnsmasq and openwrt, I'd look at the DNS server here.
My guess here would be that the DNS configuration is invalid, or the domain name incorrect, or such.
For a simple split-brain, you'll have one forward zone with your local Mac OS X Server box as the DNS server, and one (created for you) reverse DNS zone. And you'll be using a unique domain name or (far better) a publicly-registered DNS domain. But this smells like a DNS error.
Post the +dig -x+ of the IP address on your LAN, and the +dig host+ and +dig host.example.com+ of the domain name on your LAN. And given this DNS information is either public or is behind a firewall and thus accessible only via VPN, please post the real data rather than masked data.

VOIP over VPN need clarification

Hi,
Recently I have implemented Site-to-Site VPN between ASA and sonic wall firewall.
Problem: I can able to make call from ASA side(inside) Ip phone to sonic wall (inside) side Ip phone and vice versa and it’s ringing, But not able to hear voice. So I created VOIP over VPN configuration and applied appropriate service policy towards outside interface. But still I was not able to hear voice.
Tried below mentioned t’shot steps:
From ASA side we had two subnets (10.20.1.x/24 – Data and 10.20.2.x/24 – Voice ) and one subnet (192.168.x.x/24 ) from sonic wall side as interesting traffic ( lan to lan). When I configured site-to-site configuration on both ends my phase-1 and phase-2 came UP and can able to communicate between each other. (In interesting traffic I created two objects and bind those objects as one object-group for source i.e. ASA side lan subnet and one object for remote-Lan as destination)
My call manager is rest behind ASA and Ip phones needs to communicate from sonic wall side to inside ASA.
I can able to make call from ASA side(inside) Ip phone to sonic wall (inside) side Ip phone and vice versa and it’s ringing, But not able to hear voice. So I created VOIP over VPN configuration and applied appropriate service policy towards outside interface. But still I was not able to hear voice.
So, I done supernetting the data subnet and voice subnet into single network i.e. 10.20.x.x/16 at ASA side and applied the configuration changes (changed ACL, nonat rule, Voice QOS ACL accordingly), and I’m able to hear voice both end and I can communicate properly from ASA inside Ip phone to Sonic wall inside Ip phone and vice versa.
My question: I’m not understanding the logic how this supernetting resolved dead voice issue.
Pls clarify my question I’m bit confused on this.

It's not recommended. Although VPNs guarantee a secure pipe end-to-end, they don't guarantee latency and variations in latency (Jitter).

CUPC Over VPN

We resolved a VPN issue that was preventing us to be able to log in to CUPC over VPN. I am now able to log in, I can see my buddy list and their status, however the CUPC status in the bottom of the window is listed as "Offline (No Network)".
Server Health:
Logon Server: Not Connected - Disconnected
Phone Config: Downloaded
Presence: Connected
Desk Phone: Not Connected
Softphone: Not Active
Voicemail: Connected
Secure Messaging: Not Connected - Server Unreachable
LDAP: Not Available - Server Unreachable
What could be causing some of the servers to be connected while others are disconnected? We are running Microsoft ISA VPN.

This is likely an ISA VPN configuration issue. CUPC creates separate connections to each system. For example, voicemail is an IMAP or secure IMAP connection, presence is a SIP connection, desk Phone is CTI, etc. All traffic is not tunneled through CUPS.
You will need to troubleshoot the individual protocols to understand why Microsoft's VPN product is not properly transproting them. A good place to start would be attempting telnet connections from the VPN-connected machine to the locations specified in the relavent profile on CUPS. Example: Can you telnet to your LDAP server's port as defined in CUPS?

Voice over vpn-call not completing

Hi folks,
I got a problem,where with voice over vpn. So far my voip calls were running purely on shared IP internet. Today we had tried to make two side a vpn site-to-site tunnel and send traffic thru.vpn is working. (md5,des)
The problem We faced is when i dial a number, the other side party's phone rings for 6-8 seconds and the call gets disconnected.Whether or not the called party answers the call gets disconnected after 6-8 secs. Iam not getting any ring back, while actually other side phone rings. No voice is going thru.
my network is normalpbx--to--Cisco3800 to--Pix--to--QuintumGateway
isdn debug shows Cause code18-no user responding.
help me on this...

Hi,
can you provide configurations of the voice gateway and pix.
Anyway my best guess is the PIX:)
Check timers, check security policies.

No iTunes sync over VPN

I would like to do an iTunes sync over VPN but this doesn't work.
Has anyone ever done this?
I set up VPN service on my 10.6 server and VPN works fine, I can VPN on from an outside computer to my network w/ no issue and see my network.
When I VPN to my network on my iPad or iPhone, I get connected and the device gets an ip but I can't initiate a iTunes sync.
Was this just not meant to be? It should.

I'm working on trying to figure this out too. I have a working VPN setup. To sync itunes, I am thinking that the itunes on the remote computer must have an itunes library that points to the main itunes library on the host computer. I think I have changed my itunes library on my remote computer to the library on the host via Preferences and the Advanced tab. There is a place there to change the location of your itunes library. When I click change, I can navigate to the itunes media location on the host.
I am syncing now, and will be able to confirm the results tomorrow when I have access to the host. Hopefully the sync won't have messed something up. But, I am thinking this is working...

Jabber 9.5 phone service not registering over VPN

TCT devices register fine over Any Connect VPN until I upgraded to 9.5!
After upgrade IM/P and Voice Mail services connect successfully over VPN but phone service indicates it fails to get configuration from server.
Everything works locally. Any ideas what might have changed with 9.5 release that would impact ASA config!

We've come across this issue also except ours is different we can't even login. Just says username or password is invalid.
Works ok on corporate wifi
Does not work on anyconnect over internet wifi.
Does not work on anyconnect over 3G cellular data network.
I can see it connects to the TFTP server pulls the XML files down connects to each CUP server in HA but both return wrong username and password.
-- 2013-11-06 17:33:30.594 ERROR [6dee000] - [JabberWerx][log] [CupSoapCli]: login cup failed, reason: Wrong username/password
-- 2013-11-06 17:33:30.598 ERROR [3c04618c] - [JabberWerx][log] [LoginMgr]: CLoginCup::OnLoginFailed, -1, Wrong username/password
-- 2013-11-06 17:33:30.599 ERROR [3c04618c] - [JabberWerx][log] [assert]: /Users/jingwliu/depot/jwcpp/branches/s201301mobile/jwcpp/LoginMgr/LoginContext.cpp(940): CacheCupServer, ASSERT(!"CacheCupServer() not implemented.") failed!
-- 2013-11-06 17:33:30.600 INFO [3c04618c] - [JabberWerx][log] [LoginMgr]: OnStateChanged CLoginStop::OnStateChanged
-- 2013-11-06 17:33:30.601 INFO [3c04618c] - [JabberWerx][log] [LoginMgr]: conn, canceled due to no needs. supposed:0, signning-on:0, signed-on:0
-- 2013-11-06 17:33:30.601 ERROR [3c04618c] - [JabberWerx][log] [LoginMgr]: login, OnError, 10
-- 2013-11-06 17:33:30.602 ERROR [3c04618c] - [JabberWerx][log] [JabberWerxCPP]: JWLoginSink::OnError, lerr:10
-- 2013-11-06 17:33:30.602 INFO [3c04618c] - [csf-unified.imp.Login][OnLoginError] ****************************************************************
-- 2013-11-06 17:33:30.602 INFO [3c04618c] - [csf-unified.imp.Login][OnLoginError] OnLoginError: LERR_CUP_AUTH: <10>. data: 0
-- 2013-11-06 17:33:30.603 INFO [3c04618c] - [csf-unified.imp.Login][OnLoginError] **************************************************************** -- 2013-11-06 17:33:30.594 ERROR [6dee000] - [JabberWerx][log] [CupSoapCli]: login cup failed, reason: Wrong username/password
-- 2013-11-06 17:33:30.598 ERROR [3c04618c] - [JabberWerx][log] [LoginMgr]: CLoginCup::OnLoginFailed, -1, Wrong username/password
-- 2013-11-06 17:33:30.599 ERROR [3c04618c] - [JabberWerx][log] [assert]: /Users/jingwliu/depot/jwcpp/branches/s201301mobile/jwcpp/LoginMgr/LoginContext.cpp(940): CacheCupServer, ASSERT(!"CacheCupServer() not implemented.") failed!
-- 2013-11-06 17:33:30.600 INFO [3c04618c] - [JabberWerx][log] [LoginMgr]: OnStateChanged CLoginStop::OnStateChanged
-- 2013-11-06 17:33:30.601 INFO [3c04618c] - [JabberWerx][log] [LoginMgr]: conn, canceled due to no needs. supposed:0, signning-on:0, signed-on:0
-- 2013-11-06 17:33:30.601 ERROR [3c04618c] - [JabberWerx][log] [LoginMgr]: login, OnError, 10
-- 2013-11-06 17:33:30.602 ERROR [3c04618c] - [JabberWerx][log] [JabberWerxCPP]: JWLoginSink::OnError, lerr:10
-- 2013-11-06 17:33:30.602 INFO [3c04618c] - [csf-unified.imp.Login][OnLoginError] ****************************************************************
-- 2013-11-06 17:33:30.602 INFO [3c04618c] - [csf-unified.imp.Login][OnLoginError] OnLoginError: LERR_CUP_AUTH: <10>. data: 0
-- 2013-11-06 17:33:30.603 INFO [3c04618c] - [csf-unified.imp.Login][OnLoginError] ****************************************************************
I've opened a support call with our vendor.

IP phone CP7911G over VPN

Hi,
is there voice problem with CP7911G over VPN? I have a CP7911G that works fine on my network, but when i call another extension on VPN, i hear some noise during the call.

Tomcat port needs to be manually modified per following instructions:
1. Change the http port in server.xml file in \conf
value="org.apache.tomcat.service.http.HttpConnectionHandler"/>
value="8088"/> <---------- Change this to 80
2. Restart Tomcat from Windows Service Control Manager
3. Change the Cisco IP Phone Services URL's Port to 80 or remove the port from the url.
For instance,
http://:8088/ipphone/jsp/sciphonexml/IPAgentInitial.jsp
to
http:///ipphone/jsp/sciphonexml/IPAgentInitial.jsp
4. Change the URL authentication parameter is applicable. This required IPPhone to be reset via the power cord.
For instance,
http://:8088/ipphone/jsp/sciphonexml/IPAgentAuthenticate.jsp
to
http:///ipphone/jsp/sciphonexml/IPAgentAuthenticate.jsp

VPN - can't access internet over VPN

Hi,
I have an issue with VPN.
For my work I need to be able to log into my office network remotely and then access remote desktop connection from within my work network.
This won't work unless I am accessing the internet from inside the VPN.
I have got this working on a PC, just had to select "Use default gateway on remote network" and now when I access the VPN on a windows laptop I am accessing the internet over the VPN.
When I connect to the VPN on the Mac I can access the network, email server, file servers etc, but can not access the internet through the VPN.
I have tried:
- changing the service order
- ticking and unpicking the send all traffic over VPN setting
I can get to the point where I can access my work network over the VPN while also accessing the internet over my wifi but cannot get it so I can access the internet over the VPN connection. It is a PPTP VPN.
Does anyone know how I get my Mac to use the default gateway on the remote network?

If this server is behind a (NAT-) router you need to turn on "ipforwarding only" in Server Admin NAT configuration otherwise the server wont route packets beyond it's subnet.

Not able to connect remote oracle database over VPN

I can not connect remote oracle database over VPN. tnsping is ok and it shows the server information of remote database. i can also telnet the 1521 port of remote database server. I can connect the same server when it is located in the same LAN. Please help me out this is very urgent.

6b6c669e-6baa-45c4-a6dc-444aef2d5e7a wrote:
I can not connect remote oracle database over VPN. tnsping is ok and it shows the server information of remote database. i can also telnet the 1521 port of remote database server. I can connect the same server when it is located in the same LAN. Please help me out this is very urgent.
First, this is a forum of volunteers. There is no "urgent" here.
"Urgent" means one of two things -
1) people are dying, or
2) you have a customer-facing, revenue-producing production system that is down.
(And to get some perspective on the second case, keep the first in mind.)
For the first, you call whatever civil emergency service seems appropriate.
For the second, you open an SR with Oracle - which requires a paid-up support contract. For *them* to consider your problem "urgent", you will need to demonstrate that your problem falls under item #2. I seriously doubt your problem fits that criteria.
You don't have a support contract? Now you know the exact dollar figure that your company places on the data.
That said, you need to understand a few things about your specific problem,
First, port 1521 is only used by the listener to accept a connection request. Once it gets that request (and finds that it is for a service (sid) that it knows about, it will fork a server process and tell the requesting client that it can communicate with that server process over some other port .. a randomly chosen port number in the "high" range. It could be your vpn is blocking that other port, whereas your internal firewall is not.
But this is just an educated guess since I cannot find "can not connect remote oracle database over VPN" in any error message manual. If you had mentioned the VPN along with an actual oracle error message we could be much more precise in our diagnoses and recommendations.
---- edit 22 Sep
It occurred to me that I just assumed you were using the same client machine in both cases ... a laptop that you use both at work (local network) and home (vpn). If that assumption is false, there are probably problems with your tns setup on the home (vpn) machine.
But again, it would be much easier to help if you gave us an actual error message.

Remote Time Machine backup over VPN, high data usage?

I have a remote Mac mini Server running 10.10.1 in a hosted environment. I'm attempting to perform a Time Machine backup from a MacBook Pro, also running Yosemite, over VPN.
While TM does see the AFP share over VPN and is backing up, it's been working at it for almost 36 hours now. I understand than uploading a lot of data takes time, but I noticed that Activity Monitor shows that over 30GB of data has been uploaded while the TM progress bar states that only 6.35GB (of ~20GB) has been transferred. Why such a difference? I know that VPN will introduce some overhead, but this just seems ridiculous.
Does anyone have any insight into what is happening? Better yet, can anything be done to fix it?
I actually purchased the mini server for the primary purpose of having remote TM backups, but this type of data rate and transfer is almost making it look impractical.

Time Machine is a very network intensive process, it has to check to see what files have changed this requires comparing between any existing backups and the Mac itself, it may have to prune existing backups to make more room this requires various commands, it of course has to copy new or altered files, it also has to verify all of this. On top of all this as you said the VPN system itself has an overhead and TCP/IP itself does so as well.
While >30GB vs 6.35GB does seem an excessive ratio it is not impossible. It should be noted even a local first backup (the biggest) can take a great deal of time, however typically subsequent backups are a lot smaller and hence quicker.
If you were able to do a local backup and do the same measurements of amounts transferred this would at least show if the amount is normal.

Mount windows file server over vpn

I have a Windows(2003SP2) file server within some LAN with IP 192.168.10.10 and with shared folder structure like
/Sity/District/
I am authorised to connect to this LAN over VPN (it works) and to connect to /Sity, but I am authorized only to see and modify files within /District folder.
With the command 'smbclient -U username //192.168.10.10/Sity' in Terminal I can connect to the server and e.g. get all the files from /Sity/District/. However, neither mount_smbfs in Terminal nor Connect to Server in Finder can mount the share - error is
mount_smbfs: negotiate phase failed: syserr = Connection refused, Finder complain about the username and the password. The /etc/nsmb.conf has the following structure
[default]
minauth=none
Is there a way to mount such share?

Yes, it replies 'could not connect to the server because the name or password is not correct'.
Same for almost all combinations of smb://WORKGROUP;user:password@IP/Sity[/District]
I also tried different options for mount_smbfs like '-I' with no result. Error reads
mount_smbfs: negotiate phase failed: syserr = Connection refused
There is also no network browsing (mDNSResponder: NOTE: Wide-Area Service Discovery disabled to avoid crashing defective DNS relay 192.168.1.1.)
But the smbclient works and I can get the folder structure.

Is there a solution for Airprint over VPN connection?

I use a new HP airprint enabled printer in a WIFI network at home. It all works fine that far, the printer is recognized by Airprint feature on both iPhone and iPad..
Furthermore, I have established a VPN connection on my Fritzbox router and setup VPN connection on iPhone and iPad. The VPN connection (IPSec) works without any problem.
Only problem: If I try to print using the VPN connection, no printer is found. I understand it has something to do with Bonjour not working properly over VPN.
But is there any workaround or tweak to make it work somehow?
(Note: I know there is the eprint-feature on the HP printer as well, but I don´t want to use it)
Thanks

I am having the same problem. When on my local network, I have 2 AirPrint printers I can print to just fine from iPhone, iPad and iPod. However, while connected to the VPN, it doesn't see any printers.
The VPN is OS X Lion 10.7.5 VPN. It is serving addresses in the same domain and subnet as the main network. However, there is no option for routing control, so I assume routing across the network is somehow limited. Incidentally, one printer is shared from an iMac, the other is a WiFi printer.
When I connect to the VPN with my Macbook Pro, the printers don't show up as online either. However, I can ping other machines on my network, including the Lion Server (I also have a Linux server that is serving DNS and DHCP - I can log into that machine with VNC or SSH no problem).
The only ports I have open on the firewalls are the L2TP and PPTP ports, and the VNC port. But anything with printing should be within the tunnel, and not filtered by the firewall once a virtual circuit is established, right? Is there a way I can have finer control over the VPN settings, like editing a config file or something?

Layer 2 network over VPN

Similar Messages

Maybe you are looking for