<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<font size="-1"><font face="Arial">Thank you guys - Paul, Peter and
Matthew.<br>
<br>
I applied the leftsourcip= and rightsourceip= changes advocated and
suggested, and I can ping the 10.243.102.x subnet from the
10.249.100.20 VPN server now.<br>
<br>
However I still cannot ping the 10.249.100.x subnet from the
10.243.102.230 VPN server.<br>
<br>
Now, the gateway for the 10.243.102.x domain is NOT the 10.243.102.230
machine, the gateway is 10.243.102.254.<br>
<br>
I have manually added routes to the latter .254 machine to route all
traffic for the 10.249.100.x subnet through the 10.243.102.230 machine
(VPN Peer/Server). Sop I have to tweak something on the .254 machine
to allow 10.243.102.230 to ping the 10.249.100 subnet ?<br>
<br>
</font></font>>I have a VPN tunnel established between two subnets:
<br>
>10.243.102.x - the vpn server is 10.243.102.230 - 2.6.22.9-61.fc6,
Linux Openswan U2.4.5/K2.6.22.9-61.fc6 (netkey)
<br>
>10.249.100.x - the vpn server is 10.249.100.20 - 2.6.23.15-80.fc7,
Linux Openswan U2.4.7/K2.6.23.15-80.fc7 (netkey)
<br>
<br>
<pre class="moz-signature" cols="72">Regards,
Arjun Datta
</pre>
Matthew Hall wrote:
<blockquote cite="mid:482DDBD5.3010502@castleinthesky.org" type="cite">Paul
Wouters wrote:
<br>
<blockquote type="cite">On Thu, 15 May 2008, Matthew Hall wrote:
<br>
<br>
<blockquote type="cite">
<blockquote type="cite">I know that one cannot ping the actual
vpn server(s) themselves, so the
<br>
above would be normal.
<br>
But, it also appears the VPN servers themselves cannot see anything in
<br>
the opposite subnet. Is there a way around this ?
<br>
<br>
I need to pull something from one machine in the 10.243.102.x subnet
<br>
onto the 10.249.100.20 machine.
<br>
</blockquote>
This will be because when it's pinging the other side, the source
<br>
address is not in the local range provided by the vpn - ie. it's source
<br>
address will be whatever the IP is of the interface with your default
<br>
gateway, so it doesn't get routed over the vpn.
<br>
<br>
If you bind the ping to it's 'inside' interface it should work - ie.
<br>
ping 10.243.102.x -I 10.249.100.20.
<br>
<br>
You can workaround this by setting the 'defaultsource' for pluto; on
<br>
</blockquote>
<br>
A better was is to specify leftsourceip= and rightsourceip= in the
conn,
<br>
Setting it globally would limit you you to do this only on one conn.
<br>
</blockquote>
<br>
I didn't know that existed - makes my life easier :)
<br>
<br>
Thanks Paul.
<br>
<br>
Matt
<br>
<br>
</blockquote>
</body>
</html>