Cisco – Giving VPN connections access to all locations

ciscocisco-asacisco-vpnsite-to-site-vpnvpn

I have asked a similiar question, but didn't get any answers so i am going to try and rephrase.

i have 4 locations
corporate and 3 remotes

when you are at the corporate location, you have full access to all networks.
192.168.3.x
192.168.2.x
192.168.1.x
192.168.0.x

all locations are connected via site-to-site vpn with the corporate location.
if you are at a remote location, you have access to that location & the corporate location.

the corporate location handles all VPN traffic.

however, when you VPN into the corporate location, you can not see outside the corporate location.

can anyone provide some information or a link explaining how to allow the VPN users to see all locations?

thanks

static route configuration:

Gateway of last resort is 207.255.x.1 to network 0.0.0.0

C 207.255.x.0 255.255.255.0 is directly connected, outside

S 10.0.1.6 255.255.255.255 [1/0] via 207.255.x.1, outside

S 10.0.1.5 255.255.255.255 [1/0] via 207.255.x.1, outside

S 192.168.0.0 255.255.255.0 [1/0] via 192.168.0.1, inside

C 192.168.1.0 255.255.255.0 is directly connected, inside

S 192.168.2.0 255.255.255.0 [1/0] via 192.168.2.1, inside

S 192.168.3.0 255.255.255.0 [1/0] via 192.168.3.1, inside

S* 0.0.0.0 0.0.0.0 [1/0] via 207.255.x.1, outside

                 [1/0] via 192.168.1.1, outside

Best Answer

If you're sitting your VPN users in the same network as your office you need to add static routing to the other locations on your VPN client settings explicitely, unless you're using your VPN also as your default gateway.

My preferred solution though is to create a new network just for VPN remote users, this gives you a bit of a better view of who they are and what they do, from there on you can either choose to configure static routes on your clients or just activate the VPN as the default gateway for the user.

I'm not a fan of having the VPN as default gateway for the remote user traffic, so I recommend adding static routes to the configuration instead.