RRAS Persistent VPN Routing Issues

[jasonsford]

I am having trouble routing traffic from a persistent demand-dial
connection using Windows 2003 Server.

I have offices in Philadelphia and Chicago that are connected using the

setup found in these articles (albeit modified for Win2003) -
http://www.isaserver.org/tutorials/g2gisa2rraspart1.html
http://www.isaserver.org/tutorials/g2gisa2rraspart2.html

On the Philly side, I have my network setup as follows -
Networks:
VLAN1 10.10.1.0
VLAN2 10.10.2.0
VLAN3 10.10.3.0
VLAN99 10.10.99.0

The RRAS server is at LAN ip address 10.10.2.10. The IP Addresses it
receives from the Gateway to Gateway VPN are 10.10.2.150 and
10.10.9.109.

On the Philly side, the network setup is much simpler -
Networks:
VLAN9 10.10.9.0

The RRAS server is at LAN ip address 10.10.9.1. The IP Addresses it
receives from the Gateway to Gateway VPN are 10.10.9.101 and
10.10.2.154.

All VLAN traffic between both sites flows perfectly. Clients and
servers
on each side can see each other and have no connectivity problems. The
issue I am having is that when a client on the Chicago side attempts to

access the internet, it stops at my Dell 6024 switch on the Philly
side.
(For reference, the 6024 is the intermediary between the firewall at
10.10.1.1 and the VLANs 2,3, and 99. Its IP address is 10.10.2.1.)
There
are no access restrictions on the 6024's routing which prevent any
traffic from flowing.

I have a Visio diagram of the network setup as well as a text file with
the running config of the 6024 available. Any and all help would be
greatly appreciate because the "help" that Dell has provided thus far
has been no where near spectacular.

Regards,

Jason Ford
Network Administrator, ipIQ
email: (e-mail address removed)
web: http://www.ipiq.com

 

[Bill Grant]

Your Internet traffic should not be going across the VPN link. This
would be very slow if it worked. If you have a RRAS server at either end,
only 10.x.y.z traffic should be using the VPN link. Other traffic should be
going directly to the Internet from the local RRAS router.

Have a look at the routing table of the RRAS router. Does it have a
default route out to the Internet? Does it have routes to the 10. subnets
through the VPN?

 

[jasonsford]

I agree that the Internet traffic should not be going across the VPN
link. Since all traffic routing with RRAS seems to be working properly,
it looks like it is a routing issue separate from RRAS altogether.

I am going to check out the routing on the Chicago side and see whats
going on there. Thanks for the confirmation that my original feeling
was the correct one.

 

[Jason Ford]

Just a followup on this, the problem was that NAT/Firewall was not
setup for RRAS on the Chicago side. Once it was configured everything
started working flawlessly.

Thanks again.