ML350G4 + VLAN + VPN reply ping on wrong VLAN

[Joakim Hellstrom]

We have enabled VLAN on our ML350. Så we have VLAN 1, VLAN 100 - VLAN 128. VLAN 1 is the default VLAN.
The server is connected to a ProCurve 2524 on port 22. Port 22 is TAGGED on all VLAN.
For internet access there is an InGate 1450 connected with fw 4.3 (VLAN-capabilities) on port 16 whivh is TAGGED member of all VLAN.

VLAN 1 has IP 192.168.1.1, subnet 255.255.255.0 and dg 192.168.1.254.
The other VLAN has IP 192.168.x.1 and subnet 255.255.255.0 and NO dg.

If we ping internal from a client the server respond ok but if we connect to the server with VPN (IPSec handled by Ingate FW) we can ping 192.168.x.254 (dg) and clients on that VLAN but not the server UNLESS we connect to VLAN 1.

Checking the firewall log tells us that traffic comes in on the firewall on IPSec0 and goes out from fw to LAN on eth0.x, the server replies on eth0.1 and the firewall discards the package due to spoofed adress.
Thats why it only works for VLAN1.

So, why does the server respond on VLAN1 when the ping comes in on VLAN x???

[Jonathan Axford]

What is doing the routing between the subnets?

[Joakim Hellstrom]

What need to route?
It works fine locally but not with VPN.