A VPN (Virtual Private Network) is a way to securely connect two locations together across the internet.

In this case, we’ll be discussing a Lan-to-Lan connection between two offices.

Lan-to-Lan Connection

Your office is expanding and you’ve run out of IP’s.

You consult your network architect and decide to create a separate subnet, Virtual LAN (VLAN) or zone for a group of machines (e.g. a new floor or a development group).

You and the network architect get the new zone up and running and test the connectivity to the servers and internet successfully.

All is good.

A while later one of the staff on the new subnet tries to access a device at a remote office (say a printer) but it fails.

You check from the server and everything works fine.

When you try and ping the device from the machine it doesn’t respond.

You traceroute it and see that it goes out to the internet instead of through the tunnel.

Why?

The routes are all correct.

You can ping the firewall so you know it’s getting to the right location.

Why won’t it go to the remote branch?

Answer: You forgot to change the VPN tunnel to allow the new subnet to pass to the remote location!

Did you remember to add the new network to the tunnel?

Why do you need to do that?

The VPN tunnel works by matching both the source IP and destination IP to see if it needs to encrypt the traffic.

This match is done against an access control list (ACL).

If the VPN can’t match both sides it ignores the connection and lets the firewall handle it on its own.

Just having a route from the new subnet to the firewall is not enough.

How do I fix it?

In this case, you have “old subnet” connecting to “remote subnet” and you’ll need to add “new subnet” connecting to “remote subnet” to the existing tunnel ACL.

Remember to do this on both sides or it won’t work (you have to allow the traffic on the remote side to come back!).

The resultant ACL will contain instructions for “old subnet” connecting to “remote subnet” and “new subnet” connecting to “remote subnet” (reverse on the remote end).

The user can now happily access the remote device because their IP matches the local end and the destination matches the remote side – the traffic is encrypted and the device is reachable.

How do I modify my VPN tunnel to add the new subnet?

There are so many versions of firewalls that I couldn’t possibly go through them all here.

We would recommend contacting your support vendor for assistance.