Have Site-To-Site (IPSEC) connected but cannot ping anything other than router
Just setup a new Azure subscription, and i'm stumped trying to troubleshoot why I can't ping any local VMWare machines from a Azure VM. After successfully setting up an IPSec Site-To-Site VPN.
I am doing this as a learning exercise to setup a home lab, and working on my crappy networking skills :(
I have the following setup:
- Esxi Server with a VM (Portal) on a vlan50 network
- Managed switch with vlan50 tagging
- pfSense router with 192.168.20.1/24 address on vlan50
- A working IPSec tunnel from my lab 192.168.20.0/24 to Azure
virtual network 192.168.50.0/24
So for testing I created 1 VM in on-prem lab, and 1 VM in Azure
- On-prem VM [Portal] - 192.168.20.2 vlan50
- Azure VM [TestVM] - 192.168.50.100 (no vlan)
From the Portal Server, I can ping the local gateway 192.168.20.1,
And from the pfSense I can ping the Azure VM:
Ping from pfSense to AzureVM
And from the Azure Server, I can ping the 192.168.20.1 interface.
Ping from Azure to pfSense interface, not enough reputation :(
However, the VMs cannot see each otherping each other. I cannot understand this. I added rules in both IPSec & the vlan50 to allow all access to each subnet. I have a feeling my issue is either a Firewall rule, or vlan tag?
Here are some interesting things I'm noticing while troubleshooting:
- I don't see any ICMP traffic on the vlan50 interface when successfully pinging from pfSense to AzureVM
- When (unsuccessfully) pinging from AzureVM to Portal box, I see unanswered ICMP requests from 192.168.50.100 when listening on pfSense box on the vlan50 interface
I also created a very crude network outline with screenshots of the configuration I have setup: Crude Network layout
vpn vlan azure ipsec pfsense
asked Feb 27 '16 at 20:42
The Unique Paul SmithThe Unique Paul Smith
10616
add a comment |
Just setup a new Azure subscription, and i'm stumped trying to troubleshoot why I can't ping any local VMWare machines from a Azure VM. After successfully setting up an IPSec Site-To-Site VPN.
I am doing this as a learning exercise to setup a home lab, and working on my crappy networking skills :(
I have the following setup:
- Esxi Server with a VM (Portal) on a vlan50 network
- Managed switch with vlan50 tagging
- pfSense router with 192.168.20.1/24 address on vlan50
- A working IPSec tunnel from my lab 192.168.20.0/24 to Azure
virtual network 192.168.50.0/24
So for testing I created 1 VM in on-prem lab, and 1 VM in Azure
- On-prem VM [Portal] - 192.168.20.2 vlan50
- Azure VM [TestVM] - 192.168.50.100 (no vlan)
From the Portal Server, I can ping the local gateway 192.168.20.1,
And from the pfSense I can ping the Azure VM:
Ping from pfSense to AzureVM
And from the Azure Server, I can ping the 192.168.20.1 interface.
Ping from Azure to pfSense interface, not enough reputation :(
However, the VMs cannot see each otherping each other. I cannot understand this. I added rules in both IPSec & the vlan50 to allow all access to each subnet. I have a feeling my issue is either a Firewall rule, or vlan tag?
Here are some interesting things I'm noticing while troubleshooting:
- I don't see any ICMP traffic on the vlan50 interface when successfully pinging from pfSense to AzureVM
- When (unsuccessfully) pinging from AzureVM to Portal box, I see unanswered ICMP requests from 192.168.50.100 when listening on pfSense box on the vlan50 interface
I also created a very crude network outline with screenshots of the configuration I have setup: Crude Network layout
vpn vlan azure ipsec pfsense
asked Feb 27 '16 at 20:42
The Unique Paul SmithThe Unique Paul Smith
10616
add a comment |
Just setup a new Azure subscription, and i'm stumped trying to troubleshoot why I can't ping any local VMWare machines from a Azure VM. After successfully setting up an IPSec Site-To-Site VPN.
I am doing this as a learning exercise to setup a home lab, and working on my crappy networking skills :(
I have the following setup:
- Esxi Server with a VM (Portal) on a vlan50 network
- Managed switch with vlan50 tagging
- pfSense router with 192.168.20.1/24 address on vlan50
- A working IPSec tunnel from my lab 192.168.20.0/24 to Azure
virtual network 192.168.50.0/24
So for testing I created 1 VM in on-prem lab, and 1 VM in Azure
- On-prem VM [Portal] - 192.168.20.2 vlan50
- Azure VM [TestVM] - 192.168.50.100 (no vlan)
From the Portal Server, I can ping the local gateway 192.168.20.1,
And from the pfSense I can ping the Azure VM:
Ping from pfSense to AzureVM
And from the Azure Server, I can ping the 192.168.20.1 interface.
Ping from Azure to pfSense interface, not enough reputation :(
However, the VMs cannot see each otherping each other. I cannot understand this. I added rules in both IPSec & the vlan50 to allow all access to each subnet. I have a feeling my issue is either a Firewall rule, or vlan tag?
Here are some interesting things I'm noticing while troubleshooting:
- I don't see any ICMP traffic on the vlan50 interface when successfully pinging from pfSense to AzureVM
- When (unsuccessfully) pinging from AzureVM to Portal box, I see unanswered ICMP requests from 192.168.50.100 when listening on pfSense box on the vlan50 interface
I also created a very crude network outline with screenshots of the configuration I have setup: Crude Network layout
vpn vlan azure ipsec pfsense
asked Feb 27 '16 at 20:42
The Unique Paul SmithThe Unique Paul Smith
10616
Just setup a new Azure subscription, and i'm stumped trying to troubleshoot why I can't ping any local VMWare machines from a Azure VM. After successfully setting up an IPSec Site-To-Site VPN.
I am doing this as a learning exercise to setup a home lab, and working on my crappy networking skills :(
I have the following setup:
- Esxi Server with a VM (Portal) on a vlan50 network
- Managed switch with vlan50 tagging
- pfSense router with 192.168.20.1/24 address on vlan50
- A working IPSec tunnel from my lab 192.168.20.0/24 to Azure
virtual network 192.168.50.0/24
So for testing I created 1 VM in on-prem lab, and 1 VM in Azure
- On-prem VM [Portal] - 192.168.20.2 vlan50
- Azure VM [TestVM] - 192.168.50.100 (no vlan)
From the Portal Server, I can ping the local gateway 192.168.20.1,
And from the pfSense I can ping the Azure VM:
Ping from pfSense to AzureVM
And from the Azure Server, I can ping the 192.168.20.1 interface.
Ping from Azure to pfSense interface, not enough reputation :(
However, the VMs cannot see each otherping each other. I cannot understand this. I added rules in both IPSec & the vlan50 to allow all access to each subnet. I have a feeling my issue is either a Firewall rule, or vlan tag?
Here are some interesting things I'm noticing while troubleshooting:
- I don't see any ICMP traffic on the vlan50 interface when successfully pinging from pfSense to AzureVM
- When (unsuccessfully) pinging from AzureVM to Portal box, I see unanswered ICMP requests from 192.168.50.100 when listening on pfSense box on the vlan50 interface
I also created a very crude network outline with screenshots of the configuration I have setup: Crude Network layout
vpn vlan azure ipsec pfsense
vpn vlan azure ipsec pfsense
asked Feb 27 '16 at 20:42
The Unique Paul SmithThe Unique Paul Smith
10616
asked Feb 27 '16 at 20:42
The Unique Paul SmithThe Unique Paul Smith
10616
edited Feb 27 '16 at 20:47
The Unique Paul Smith
asked Feb 27 '16 at 20:42
The Unique Paul SmithThe Unique Paul Smith
10616
asked Feb 27 '16 at 20:42
The Unique Paul SmithThe Unique Paul Smith
10616
asked Feb 27 '16 at 20:42
The Unique Paul SmithThe Unique Paul Smith
10616
10616
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
Doh! I found the answer was the fact that my Portal machine that's on-premise has multiple NIC, and the default Gateway doesn't know that route. I added a static gateway and was able to successfully ping each machine
answered Mar 30 '16 at 2:31
The Unique Paul SmithThe Unique Paul Smith
10616
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1046287%2fhave-site-to-site-ipsec-connected-but-cannot-ping-anything-other-than-router%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Doh! I found the answer was the fact that my Portal machine that's on-premise has multiple NIC, and the default Gateway doesn't know that route. I added a static gateway and was able to successfully ping each machine
answered Mar 30 '16 at 2:31
The Unique Paul SmithThe Unique Paul Smith
10616
add a comment |
Doh! I found the answer was the fact that my Portal machine that's on-premise has multiple NIC, and the default Gateway doesn't know that route. I added a static gateway and was able to successfully ping each machine
answered Mar 30 '16 at 2:31
The Unique Paul SmithThe Unique Paul Smith
10616
add a comment |
Doh! I found the answer was the fact that my Portal machine that's on-premise has multiple NIC, and the default Gateway doesn't know that route. I added a static gateway and was able to successfully ping each machine
answered Mar 30 '16 at 2:31
The Unique Paul SmithThe Unique Paul Smith
10616
Doh! I found the answer was the fact that my Portal machine that's on-premise has multiple NIC, and the default Gateway doesn't know that route. I added a static gateway and was able to successfully ping each machine
answered Mar 30 '16 at 2:31
The Unique Paul SmithThe Unique Paul Smith
10616
answered Mar 30 '16 at 2:31
The Unique Paul SmithThe Unique Paul Smith
10616
answered Mar 30 '16 at 2:31
The Unique Paul SmithThe Unique Paul Smith
10616
answered Mar 30 '16 at 2:31
The Unique Paul SmithThe Unique Paul Smith
10616
10616
add a comment |
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1046287%2fhave-site-to-site-ipsec-connected-but-cannot-ping-anything-other-than-router%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
