How can I pass broadcast discovery traffic across a BOVPN?

sanfordsanford
in Firebox - VPN Branch Office

Good day,

I want to broadcast a discovery packet across a BOVPN. Below is the packet that needs to pass through the BOVPN that the Traffic Monitor is showing as being blocked:

2019-10-28 15:33:57 Deny 192.168.6.125 255.255.255.255 10024/udp 60752 10024 1-Trusted Firebox Denied 34 64 (Unhandled Internal Packet-00) proc_id="firewall" rc="101" msg_id="3000-0148"

We are not doing any NAT and the two networks are bridged via a BOVPN with Watchguards as follows:

LAN at office A:
192.168.0.1/20

LAN at office B
192.168.16.1/24

I have enabled broadcast traffic across the tunnel and have assigned helper IP addresses as per the documentation (172.16.0.1 on one side and 172.16.0.2 on the other), but it still doesn't work.

I can assign static IP addresses to both the transmitting device at office A and the receiving device at office B.

What happens is that when I launch the app at office A, it sends out the packet I included above and waits for responses for the hardware device on the LAN at office B. The hardware device is supposed to respond to the sending address with it's IP address so it can be discovered.

The app has no trouble discovering the hardware device if both are on the same subnet and local network, but does not work across the BOVPN.

Any suggestions?

Thank you.

Bill Sanford

Comments

  • Bruce_BriggsBruce_Briggs

    "Deny 192.168.6.125"
    Typo here ? you have not mentioned the 192.168.6.0 subnet above.
    Where it it located ? Office B ?

    On which firewall are you seeing this deny?

  • sanfordsanford

    192.168.6.125 is part of office subnet A (192.168.0.1/20). The Watchguard firewall at office A is denying.

  • Bruce_BriggsBruce_Briggs

    Sorry - missed the /20 subnet mask.

    Is your BOVPN Tunnel setting for Local = 192.168.0.1/20 ?

  • sanfordsanford

    Thanks Bruce!
    Site A tunnel is 192.168.0.0/20 and site B is 192.168.16.0/24

  • Bruce_BriggsBruce_Briggs

    Since it looks to me that you do have this set up correctly, time to open a support incident so that a WG rep can help get this working.
    Should you find a resolution, please post it.

  • sanfordsanford

    Thanks Bruce. Will do.

Sign In to comment.