Re: A PC with 2 NICs, one for SBS network, one for VPN, VPN doesnot work if the PC is connected to SBS network

Jack wrote:
> This PC has 2 NICs, one is connected to SBS network, the other one is
> connected to a Juniper VPN router which is totally isolated from SBS
> network.
>
> We noticed that we could not leave this PC connected to SBS network if
> we want to use VPN. If we disconnect from SBS network, VPN works fine.
>
> Is there any way we can leave both NICs connected and use VPN? If we
> disconnect from SBS network, the user can not use internet.
>
> I have a feeling this is due to the “Metric” priority of the two
> networks gateways – when the SBS Network is connected – that Gateway
> has a higher Metric and this is diverting any traffic.
>
> I am not sure i am right and how to fix this. Any one can shed me some
> light?
>

Yes, it is routing. It's not a matter of priorities, a computer can have
only one default gateway, and there may also be a network address
conflict. What you need to do is to leave the LAN NIC to pick up DHCP
information from the SBS, which will include the default gateway
address, and set up manual routes in the PC for the other NIC. These
routes will be used for VPN traffic in preference to the default gateway.

As Cris says, you need to look at what you're connecting through the
VPN. Whatever networks are reached that way must have persistent manual
routes set up in the PC, specifying the 'VPN' NIC as interface and the
VPN router address as gateway. You use the 'route' command from a
command prompt to do this. Don't forget the -p flag to make the routes
persistent, or they will be lost at the next boot. Don't forget to
document them, as well.

All of the networks on the other side of the VPN, and the SBS LAN
network, must have different network addresses. You may need to alter
your addressing scheme to achieve that. The address of the tiny network
formed by the PC and VPN router connections may need to be different
again if the VPN is configured to route its connections, or it must be
the same as that of the other side of the VPN if the VPN is configured
to bridge the connections.

--
Joe

> On Nov 18, 1:33Â*pm, Joe <j...@jretrading.com> wrote:
>> Jack wrote:
>>> This PC has 2 NICs, one is connected to SBS network, the other one is
>>> connected to a Juniper VPN router which is totally isolated from SBS
>>> network.
>>
>>> We noticed that we could not leave this PC connected to SBS network if
>>> we want to use VPN. If we disconnect from SBS network, VPN works fine.
>>> Is there any way we can leave both NICs connected and use VPN? If we
>>> disconnect from SBS network, the user can not use internet.
>>> I have a feeling this is due to the “Metric� priority of the two
>>> networks gateways – when the SBS Network is connected – that Gateway
>>> has a higher Metric and this is diverting any traffic.
>>> I am not sure i am right and how to fix this. Any one can shed me some
>>> light?
>>
>> Yes, it is routing. It's not a matter of priorities, a computer can have
>> only one default gateway, and there may also be a network address
>> conflict. What you need to do is to leave the LAN NIC to pick up DHCP
>> information from the SBS, which will include the default gateway
>> address, and set up manual routes in the PC for the other NIC. These
>> routes will be used for VPN traffic in preference to the default gateway.
>>
>> As Cris says, you need to look at what you're connecting through the
>> VPN. Whatever networks are reached that way must have persistent manual
>> routes set up in the PC, specifying the 'VPN' NIC as interface and the
>> VPN router address as gateway. You use the 'route' command from a
>> command prompt to do this. Don't forget the -p flag to make the routes
>> persistent, or they will be lost at the next boot. Don't forget to
>> document them, as well.
>>
>> All of the networks on the other side of the VPN, and the SBS LAN
>> network, must have different network addresses. You may need to alter
>> your addressing scheme to achieve that. The address of the tiny network
>> formed by the PC and VPN router connections may need to be different
>> again if the VPN is configured to route its connections, or it must be
>> the same as that of the other side of the VPN if the VPN is configured
>> to bridge the connections.
>>
>> --
>> Joe
>
> Hi Joe, Thanks for the insights!
>
> How can I "set up manual routes in the PC for the other NIC"???
>
> The two networks are on different IP schemes
> SBS network: 192.168.16.x
> VPN network: 10.101.1.X, gateway:10.101.1.1


What is the gateway (router) on the SBS network? Do you have two ISP
lines coming in to the office?

You can view the machine's routing table by the 'route print' command.
It can also be altered with this command, however I do not recommend
this course of action due to it may cause issues with the client
machine on the SBS network, considering this machine is joined to the
domain.

Honestly, the better way to do this is to connect to the VPN through
the SBS network. However, a better understanding of the current two
networks this workstation is connected to would better help.

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Please reply back to the newsgroup or forum for collaboration benefit
among responding engineers, and to help others benefit from your
resolution.

Ace Fekay, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007, MCSE &
MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer

For urgent issues, please contact Microsoft PSS directly. Please check
http://support.microsoft.com for regional support phone numbers.

> On Nov 18, 10:19Â*pm, Ace Fekay [MCT] <ace...@mvps.RemoveThisPart.org>
> wrote:
>>> On Nov 18, 1:33Â*pm, Joe <j...@jretrading.com> wrote:
>>>> Jack wrote:
>>>>> This PC has 2 NICs, one is connected to SBS network, the other one is
>>>>> connected to a Juniper VPN router which is totally isolated from SBS
>>>>> network.
>>
>>>>> We noticed that we could not leave this PC connected to SBS network if
>>>>> we want to use VPN. If we disconnect from SBS network, VPN works fine.
>>>>> Is there any way we can leave both NICs connected and use VPN? If we
>>>>> disconnect from SBS network, the user can not use internet.
>>>>> I have a feeling this is due to the “Metric� priority of the two
>>>>> networks gateways – when the SBS Network is connected – that Gateway
>>>>> has a higher Metric and this is diverting any traffic.
>>>>> I am not sure i am right and how to fix this. Any one can shed me some
>>>>> light?
>>
>>>> Yes, it is routing. It's not a matter of priorities, a computer can have
>>>> only one default gateway, and there may also be a network address
>>>> conflict. What you need to do is to leave the LAN NIC to pick up DHCP
>>>> information from the SBS, which will include the default gateway
>>>> address, and set up manual routes in the PC for the other NIC. These
>>>> routes will be used for VPN traffic in preference to the default gateway.
>>>> As Cris says, you need to look at what you're connecting through the
>>>> VPN. Whatever networks are reached that way must have persistent manual
>>>> routes set up in the PC, specifying the 'VPN' NIC as interface and the
>>>> VPN router address as gateway. You use the 'route' command from a
>>>> command prompt to do this. Don't forget the -p flag to make the routes
>>>> persistent, or they will be lost at the next boot. Don't forget to
>>>> document them, as well.
>>
>>>> All of the networks on the other side of the VPN, and the SBS LAN
>>>> network, must have different network addresses. You may need to alter
>>>> your addressing scheme to achieve that. The address of the tiny network
>>>> formed by the PC and VPN router connections may need to be different
>>>> again if the VPN is configured to route its connections, or it must be
>>>> the same as that of the other side of the VPN if the VPN is configured
>>>> to bridge the connections.
>>
>>>> --
>>>> Joe
>>
>>> Hi Joe, Thanks for the insights!
>>
>>> How can I "set up manual routes in the PC for the other NIC"???
>>> The two networks are on different IP schemes
>>> SBS network: 192.168.16.x
>>> VPN network: 10.101.1.X, gateway:10.101.1.1
>>
>> What is the gateway (router) on the SBS network? Do you have two ISP
>> lines coming in to the office?
>>
>> You can view the machine's routing table by the 'route print' command.
>> It can also be altered with this command, however I do not recommend
>> this course of action due to it may cause issues with the client
>> machine on the SBS network, considering this machine is joined to the
>> domain.
>>
>> Honestly, the better way to do this is to connect to the VPN through
>> the SBS network. However, a better understanding of the current two
>> networks this workstation is connected to would better help.
>>
>> --
>> Ace
>>
>> This posting is provided "AS-IS" with no warranties or guarantees and
>> confers no rights.
>>
>> Please reply back to the newsgroup or forum for collaboration benefit
>> among responding engineers, and to help others benefit from your
>> resolution.
>>
>> Ace Fekay, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007, MCSE &
>> MCSA 2003/2000, MCSA Messaging 2003
>> Microsoft Certified Trainer
>>
>> For urgent issues, please contact Microsoft PSS directly. Please
>> checkhttp://support.microsoft.comfor regional support phone numbers.
>
> Thanks ACE!
>
> YES, I have two ISP lines coming in. One goes to Netgear router that
> is for office network; the other one goes to Juniper VPN router. The
> second NIC of the computer is connected to Junipter VPN router. For
> security reasons, we used a second NIC for VPN on this computer,
> rather than thru SBS network via the VPN client software.
>
> Does this make sense to you?
>
> Thanks
>
> Jack

Yes, that does make more sense. So you have two ISPs. What you are
trying to do is problematic because you are trying to literally use two
gateways. THe idea with a 'gateway' is that it is the 'doorway to the
outside world,' so to speak. But there can only be one default gate or
doorway. You can create additional ones, but they have to be to
specific destinations.

You can alter the routing table so when you connect to the VPN IP
address, you can create a route entry to use the ISP2 (the non-SBS
network) as the gatway, otherwise for all other traffic, you need to
use ISP1 (SBS network). That's done by the route print command.

Honestly, I do not see a security issue with using client to server VPN
on the SBS side. Remember, VPN traffic is secured and closed, so the
traffic, if anything, will not 'see' the network. But then again, if a
bad guy (malware) were to come across the VPN whether using ISP1 or
ISP2, it will infect the machine and cause problems on the SBS network
ANYWAY because it is direcly connected to it. So I do not see any
advantage to your solution, if you see what I mean...

Ace

> Thank you Ace for the detailed analysis!
> I will re-think about this and may give up this second ISP
>
> Have a nice weekend,
>
> Jack

You are welcome. Also, you will save some money eliminating the
additional ISP.

You have a great weekend, too!

Ace