Routing problem over VPN from Vigor 2600+ to Netscreen 5GT

Archived from groups: comp.dcom.vpn (More info?)

Hi -

I've recently been having fun creating a VPN for my company's VoIP.

A schematic is below [read in fixed text].

001234567890 / \
PC / \
PCs / \
\ / \
+-> Draytek <---------> Netscreen <---+--> Windows
<-------------+-----> PCs
/ Vigor 2600+ / 5GT | Server 2000
/ / | \
| / |\
| / | \
v / | \ v
IP Office 206

Windows Server 2000 is acting as a router.

The VPN tunnel between and seems to work fine,
although I am slightly worried that the tunnel only appears to be initiated
from the subnet. I can successfully ping .0.0/24 from
..2.0/24, and vice versa.

I have two problems. First of all, I am unable to ping any address on the subnet from subnet, despite having created a
static route in the Vigor 2600+ ( -> gateway:

Trace route display from


Tracing route to backup.leax.local []
over a maximum of 30 hops:

1 <10 ms <10 ms <10 ms my.router []
2 * * * Request timed out.
3 * * * Request timed out.
4 ^C


To my untrained eyes, it looks as if my static route is being ignored, and
the packets are going onto the WAN, rather than down the VPN tunnel.

Secondly, I am unable to ping any address on the subnet from, other than the Draytek router.

Trace router display from


Tracing route to riza []
over a maximum of 30 hops:

1 <10 ms <10 ms <10 ms leaxserver1.leax.local []
2 <10 ms <10 ms <10 ms
3 36 ms 34 ms 37 ms
4 * * * Request timed out.
5 ^C

Again, it looks as if it gets to the Draytek box, and then goes out onto the

Can anybody suggest something that I could try to get this sorted?

Mark Bertenshaw
Network Manager
LEAX Controls Ltd.
1 answer Last reply
More about routing problem vigor 2600 netscreen
  1. Archived from groups: comp.dcom.vpn (More info?)

    Sorry about the diagram - I thought it newlined at 78 chars!

    Anyhow, it turned out to be an issue with the Draytek Vigor 2600+. When I
    added my static route, I had only one item in the dropdown for Network
    Interface (LAN) - and I didn't notice this. Of course, if I want to go down the VPN tunnel, this is the wrong interface. So how
    do I get to see further interfaces in this dropdown? Well, it seems that
    you can't. Instead you have to go to the setup for the outgoing VPN tunnel,
    and scroll right to the bottom to Section 4 (TCP/IP Network Settings).
    Below "Remote Network IP" and "Remote Network Subnet", there is a button
    saying "More". Pressing this takes you to a dialogue where you can
    associate as many Address/Subnet values as you like with this tunnel. But
    this is the sneaky thing: these values only take effect when you reboot the
    the Vigor 2600+ !! Now, if you go to the Static Routing table, you will see
    the addresses have been added as static routes, with IF = 4+. After
    reinstating the routing on the Netscreen 5XP ( -> Trust), you
    can ping; and interestingly, this also fixes the -> pinging problem. Fantastic!

    Mark Bertenshaw
    Kingston upon Thames
Ask a new question

Read More

vpn Networking