Cannot access device connected to trust interface on Netsc..

Archived from groups: comp.dcom.vpn (More info?)

Hi -

I currently have a problem with a VoIP system which works via a tunnel
between a Draytek Vigor 2600+ Router and a Netscreen 5GT. The layout is
below (fixed font recommended).

192.168.2.200 192.168.2.1 192.168.0.1 192.168.0.3

IP Draytek Netgear Avaya
Phone <----> Vigor <--TUNNEL--> 5GT 4 <-----> IP
2600+ Office
1
^
|
v

192.168.0.2

Windows 10.0.0.2 <----> PCs
Server

The IP address of the Netgear's Untrust interface is 195.184.244.98 . The
Windows Server is connected to Trust port 1, and the IP Office (PBX) is
connected to Trust port 4. The Windows Server is multihoned, and most of
our PCs connect to the 10.0.0.2 interface. Unfortunately, it seems that the
IP Phone cannot connect to the IP Office. Nor can a PC on 192.168.2.0/24,
for that matter. Funnily enough, it is still possible to ping 192.168.0.3 .
But the tracert (trace route) utility gives the following interesting
results:

Tracing route to 192.168.0.3 over a maximum of 30 hops

1 <10 ms <10 ms <10 ms Linford.Street [192.168.2.1]
2 30 ms 40 ms 40 ms adsl-195-184-244-98.mistral-uk.net
[195.184.244.
98]
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.
6 40 ms 50 ms 40 ms 192.168.0.3

This seems to suggest that the packets are going somewhere interesting. I
would guess that they are somehow going to the Windows server, and not the
IP Office. However, surely all packets are sent to all the trust interfaces
at the same time?

Interestingly, even the server seems to have a similar problem, judging by
the following output on the console:

Z:\>tracert 192.168.0.3

Tracing route to 192.168.0.3 over a maximum of 30 hops

1 * * * Request timed out.
2 <10 ms 10 ms <10 ms 192.168.0.3

Trace complete.


I would guess that this is a routing problem, although could it also be due
to policies? A similar problem happens with users who access the firewall
via a tunnel created by Netscreen Remote: they can't access 192.168.0.3, and
trace route doesn't work at all.

Any ideas?

--
Mark Bertenshaw