Site2Site VPN and IKEv2 VPN - No Route to Remote Site

Jenz

Hello,

I have a problem with my ATP.

There are 2 different VPNs:

• Site2Site (HQ<->EXT): 172.16.0.0/16 (HQ) to 172.17.0.0/16 (External Site)
• IKEv2 for clients (HQ): Range 192.168.10.10 to 192.168.10.100

The S2S connection to the external site (EXT) works without problems when I use it in the HQ, i.e. without an additional VPN.

The IKEv2 clients (HQ) can also connect to the HQ and access the corresponding services.

However, the problem is that the IKEv2 clients (HQ) cannot access services running on the external site (EXT). It seems that the IKEv2 clients cannot access the S2S VPN.

Nothing blocked can be seen in the firewall.
I think there is still a route missing that is needed for the IKEv2 clients.

Can anyone help me with what I am doing wrong here or what is still missing?

Thank you very much!

PeterUK

looks like you need routeing rules

HQ

incoming tunnel VPN of IKEv2 for clients

destination 172.17.0.0/16

next hop VPN Tunnel Site2Site

External Site

incoming any

destination 192.168.10.10 to 192.168.10.100

next hop VPN Tunnel Site2Site

Jenz

Thank you for your answer.

I have tried it with the 2 routes, but unfortunately it still doesn't work.
(changed the IKEv2 IP Range to 192.168.112.10-100)

HQ:

Ext:

PeterUK

You may also need policy rules on each to allow the traffic

check your logs for blocked traffic