Intranet Network Lag And Cannot Connect VPN

|
  • 103
  • 6

Issue Description

The IAM is deployed between the core switch and the firewall, intranet network lag and cannot connect VPN.

Handling Process

1. Open troubleshooting bypass for the intranet PC or the VPN address on IAM, no logs available and issue still exists.

2. Open global exclusion for the intranet PC or the VPN address on IAM, the problem remains.

3. Physically bypass the IAM and the issue fixed.

4. Capture packets on the IAM. The data passes through the IAM in both directions. The network packet is found to be inconsistent with the destination MAC address of the network packet sent by the core switch. The normal network packet encapsulates the MAC address of the firewall LAN port, and the abnormal network packet encapsulates the MAC address of the IAM, IAM will not modify the core switch ARP or reject it.

Root Cause

Two default routes are written on the core switch. One next hop points to the LAN port address of the firewall, and the other one points to the bridge IP of the IAM. The core switch will request the MAC address of the IAM, causing some packets to encapsulate the MAC address of the IAM (ec-d6-8a-21-39-5e), as shown below:

The normal network packet should be encapsulating the MAC address of the  firewall LAN port (ec-d6-8a-29-20-55), as shown below:

Solution

Remove the default route at the core switch that next hop points to the IAM LAN port address.
Faisal Posted 19 Aug 2020 09:42
  
Thank you very much for the information ...
Faisal Posted 25 Oct 2020 06:26
  
Nice article ...
Faisal Posted 15 Dec 2020 08:32
  
Great info ...
Ellechar Lv4Posted 28 Jan 2021 11:59
  
Very nice infoooooooooooooooooooooooooooooo
Faisal Posted 17 Mar 2021 07:30
  
Very informative …
Faisal Posted 02 Jun 2021 07:42
  
Nice guidance ...

I want to write a case
Doc ID: 2623
Author: Sangfor_Yong
Updated: 2019-12-23 15:08
Version: