Draytek 2600 and VPN

Hi

Being driven mad with this.

Remote site using ip 10.1.104/24

Head Office using 10.1.128.0/17, 10.1.1.0/24 & 10.1.5.0 /24 with Cisco VPN 3005 concentrator

I can define a tunnel from 10.1.104.0 <--> 10.1.128.0 and it works fine
However when I add the other other subnets to the configuration they don't connect.

the IKE Session comes up fine
the IPSEC tunnel for 10.1.128.0 comes up fine, but none of the others come up.

No entries in the logs at either end to indicate what the problem is (just the sucessfull ones for the working tunnel).

If I try really hard sometimes I can get one of the other tunnels up (usually ping -t and then force a disconnetion at one end) but then the other tunnels don't come up.

Has anyone here tried anything similar and got it to work.

The Draytek is running firmware : 2.5.9_UK

All those IP addresses are in private IP address ranges. Are you trying to access them over the internet?

No, that's what the VPN tunnels are for.

But doesn't VPN normally use the internet between remote sites?

Yes it does,

But as far as the internet is concerned all it sees is data between the public IP addresses of the devices at each end of the tunnel. It doesn't care about the actual payload of the packets (which is where the private address information is transmitted).

I have three sites all with Class B (/16) subnets. 10.0.0.0/16 10.1.0.0/16 and 10.2.0.0/16 (255.255.0.0 mask)

I use DrayTek 2600 routers on all the sites and find that if the two remote sites 10.1 and 10.2. initiate the connections it all works fine (although the two remote sites never need to talk to each other direct, so never tried it.

Howeverr, if the central site (10.0) tries to initiate the connections, then the DrayTeks get confused somewhere along the line and only one connection works at a time.

I'd guess that the draytek doesn't expect /16's - I've had no problems with /24's.

Tried their forum?

James

Tried that,

Made sure the connections were down at both ends, then got the remote site to initiate the connection, but still only get the one tunnel up.

Are your connections all routed through the central site, or do all the sites connect to each other directly?

The nature of what I need to do is that the remote sites talk to the central (and vice versa).

But the remote sites never need to talk to each other.

Simplifies the job, doesn't it.

The DrayTek handles the /16s OK.

I just had trouble with the Central site connecting to two remote sites, at the same time.

When I let the two remotes initiate the connections, it all just worked.

In its current configuration it ain't broke, so I don't feel any need to fix it.