+- FocusCanada Forums (//www.focuscanada.net/forum)
+-- Forum: Canadian Focus Community (//www.focuscanada.net/forum/forumdisplay.php?fid=3)
+--- Forum: Off Topic (//www.focuscanada.net/forum/forumdisplay.php?fid=16)
+--- Thread: A Question For Noz2got4me (/showthread.php?tid=8317)
A Question For Noz2got4me - paolo - 09-05-2006
Nos:
I have 2 lan networks connected to the internet that need to be connected together through a Cisco VPN box WRV200 which also doubles as a router. both networks have a static rogers ip, well mine is a fixed wireless OFDM 802.16 but that doesnt matter, I'm looking to have it set up so I can click my network Neighbourhood and browse fileshares on the other lan... is this something your good at? since your well known for knowing this stuff.
A Question For Noz2got4me - NOS2Go4Me - 09-05-2006
Your Network Neighbourhood will be limited by one or more of the following:
WINS resolution of neighbouring computers (must have the same subnet/mask as querying computers)
Co-habitation of the same network (192.168.x.x/255.255.255.0 for a standard class C setup) or the ability to inform them of different networks.
-----
Here's what you can do, and until I know a bit more of the basic topology this is purely "sketchwork":
Assign an IP to the network card of the querying computer that resides in the same submet as the destination LAN. So, if your local LAN is 192.168.1.X/24 and your destination LAN is 192.168.5.X/24, assign a 192.168.5.X/24 IP to the network card of the querying computer.
So, you should have two IPs on the computer you're working from when you're done. Now comes the interesting part. You're going to need to tell your computer that all traffic for the destination LAN needs to be routed to a certain area. I'm assuming that the internal interface of your VPN box has IPs to cover both subnets and allow both subnets access to the Internet, right? It'll have 192.168.1.1 and 192.168.5.1 or somesuch.
This is done one of two ways. The easy way is to set a new gateway on YOUR network card for 192.168.5.1 with a metric of, say, 20. It's arbitrary, but it should be a number greater than 1 and I tend to use greater than 10 for seldom-used networks. It's just the way I do it. There's no tech. advantage to using a higher or lower number, just so long as you remember NOT to use 1.
Now, try pinging a destination LAN computer from YOUR machine. If it works, try Network Neighbourhood. If the first part fails, you have routing issues that need to be resolved before you go further unless a firewall is squelching ping replies or the target computer's firewall is ignoring them. If you can ping the destination computer from another computer on the destination computer's LAN, then you'll need to ensure that you can access everything physically from your LAN.
Failing that, you can add a static route to the destination subnet with a ROUTE ADD command. Do this by opening a command window and performing the following command:
ROUTE ADD (capitalized for highlighting important portions only, caps mean nothing to Windows here) 192.168.X.0 (where X is your dest. subnet, replace other octets as required) MASK 255.255.255.0 (fix as required) 192.168.5.1 (this is your gateway address). Now, if 5.1 and 1.1 are on the same adapter as different aliases, then you might be able to set 1.1 as your gateway and the ARP table on the router should be able to redirect your packets accordingly. That commandline command again to add the route, without my gunk in it, is:
route add 192.168.5.0 mask 255.255.255.0 192.168.5.1
You can also add that string of characters to a text file, rename the text file extension to .bat and then add a shortcut to it into your startup folder and have it loaded every time you log onto WIndows if need be.
Try pinging the destination computer again. If you get ping replies, try Network Neighbourhood.
On that note, I'd recommend a mapped network drive to the target computer as opposed to using Network Neighbourhood. :)
-----
Edit, I missed the Rogers IP portion. *scratches head*
So you have a separate LAN interface leading to each network on the Cisco box? Unless they share the same "back end" of the Cisco box, they won't be able to fileshare at all as you'd have to open way too many ports to allow network browsing and file sharing traffic through... especially a few service ports that should NEVER be open to the Internet. What I described will work for two subnets sharing the same copper/airwaves for a LAN, but it won't work for two entirely separated/segmented networks on different copper.
If what I assumed earlier was true, as shown below, then what I said will work.
![[Image: th_b11fdcf4.jpg]](http://i22.photobucket.com/albums/b322/loganteamx/b11fdcf4.jpg)
A Question For Noz2got4me - Drivesthebeast - 09-05-2006
I began reading some of you guys' stuff, but it felt like my head might explode... :lol:
A Question For Noz2got4me - reldridge - 09-05-2006
paolo,Sep 4 2006, 11:54 AM Wrote:Nos: both networks have a static rogers ip
NOS, reading that, I think he has two seperate LAN's at two seperate locations. Am I right there, Paolo? Or am I on crack? :)
Ryan
A Question For Noz2got4me - NOS2Go4Me - 09-05-2006
I was hoping they were inter-tied on the back end and each talking out through their respective Rogers IPs on the Inet-visible side. Failing that, he's screwed.
A Question For Noz2got4me - paolo - 09-06-2006
Actually Nos, reldridge's right
its more like
Lan 1 -> VPN/Router -> Cable Internet
Lan 2 -> VPN/Router -> Nextnet OFDM Internet Modem -> Rogers Cell Tower
So far, lan 1 and 2 are connected via VPN and I can Ping/Tracert the 192xx of the other lan workstations. I actually took your advice and dont want to use network neighbourhood, id rather just use the map network drive method. Nos: After reading some of your previous post, I managed to be able to browse the oter workstation via the vpn ONE WAY ONLY and it happened to work very well, I'm just going to concentrate now on tweaking it so it works both ways now.
A Question For Noz2got4me - NOS2Go4Me - 09-06-2006
Mmmm if you can VPN from one network to the other, you need to configure another VPN going in the other direction for it to be "bi-directional". Ideally, you can create a VPN end-point for each network, connect them each via PSK (pre-shared key) and then have a permanent VPN for two-way traffic. This would best be done with L2TP/IPSec. However, VPN by nature is client to server / client to appliance and therefore at some point the client must be the server and vice-versa if you want opposite flow traffic to work. Ping replies are just being returned to the client, but server-generated pings will not work with just one VPN connection active.
Make sense?
I'm also not sure what a "permanent", always-active dual-VPN connection would do to your box in terms of performance. It may not even notice the extra load, or it could seriously chug. YMMV.