<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Rescued from the Spam bucket. Please remember to subscribe to the mailing list before posting to it.<br><div><br><div><div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family:'Helvetica'; color:rgba(127, 127, 127, 1.0);"><b>From: </b></span><span style="font-family:'Helvetica';">Jon Slusher <<a href="mailto:jonslusher@gmail.com">jonslusher@gmail.com</a>><br></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family:'Helvetica'; color:rgba(127, 127, 127, 1.0);"><b>Subject: </b></span><span style="font-family:'Helvetica';"><b>Trouble routing ASA VPN-connected subnet through Cisco 1900 <-> openswan tunnel</b><br></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family:'Helvetica'; color:rgba(127, 127, 127, 1.0);"><b>Date: </b></span><span style="font-family:'Helvetica';">September 16, 2014 at 1:00:31 PM GMT-4<br></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family:'Helvetica'; color:rgba(127, 127, 127, 1.0);"><b>To: </b></span><span style="font-family:'Helvetica';"><a href="mailto:users@lists.openswan.org">users@lists.openswan.org</a><br></span></div><br><br>Ill try to describe this properly. Ive been looking for answers to this on the list already, but Im not having any luck. I have a main" network into which there is a VPN tunnel provided by an ASA for remote access. Within that main network, there is a Cisco 1900 gateway that connects to multiple tunnels. Two of them are AWS VPCs and one of them has an openswan server on the other side. I can get through the tunnel to the openswan server from within the main subnet, I can also get to the VPCs from the ASA when connected to the VPN, but I cant get to the openswan gateway from the ASA. Ive been able to pinpoint the problem at the tunnel itself, but Im not sure which side is to blame. I suspect the openswan side because the VPC tunnels work fine from the ASA.<br><br>I can get from the main to the openswan, but I cant get from the ASA to the openswan. <br><br>The ASA can however get across the tunnels to the VPC networks that exist on the same router.<br><br>Here is what I hope is enough info to get this started. Thanks in advance for the help.<br><br>--------------------------------------------------------<br>ASA - 192.168.88.0/24<br><br>ASA gateway - 192.168.21.10<br><br>main network - 192.168.20.0/22<br><br>Cisco 1900 gateway - 192.168.21.25<br><br>openswan network - 192.168.100.0/24<br><br>openswan gateway - 192.168.100.1<br><br>Here are the relevant parts of the configs:<br>---------------------------<br>openswan:<br><br>conn main<br> authby=secret<br> auto=start<br> type=tunnel<br> left=xxx.xxx.xx.xx<br> leftid=xxx.xx.xxx.xx<br> leftsubnet=192.168.100.0/24<br> leftnexthop=%defaultroute<br> right=xxx.xx.xxx.xx<br> rightsubnets={192.168.20.0/22 192.168.88.0/24}<br> rightnexthop=%defaultroute<br> phase2=esp<br> phase2alg=aes256-sha1;modp2048<br> forceencaps=yes<br> dpddelay=30<br> dpdtimeout=120<br> dpdaction=restart<br> pfs=yes<br><br><br>Cisco 1900:<br><br>show ip route:<br>C 192.168.88.0/24 is directly connected, GigabitEthernet0/1<br>S 192.168.100.0/24 is directly connected, Tunnel5<br><br>show run:<br>ip route 192.168.20.0 255.255.252.0 192.168.21.5<br>ip route 192.168.88.0 255.255.255.0 192.168.21.10<br>ip route 192.168.100.0 255.255.255.0 Tunnel3<br><br><br>ASA VPN:<br><br>access-list Tunnel3 standard permit 192.168.100.0 255.255.255.0<br>ip local pool vpn_dhcp 192.168.88.5-192.168.88.254 mask 255.255.255.0<br>route inside 192.168.21.0 255.255.255.0 192.168.21.5 1<br><br><br><br><br></div></div></div><br></body></html>