topic Firewall Services Mod (Transparent Mode) VPN issues in Network Security

Firewall Services Mod (Transparent Mode) VPN issues

jbanker — Mon, 11 Mar 2019 08:59:00 GMT

I am using a FWSM in transparent mode on a 6509 and I am running into issues using the Microsoft VPN client with NAT. Currently, I have NAT setup on my router and when I try to VPN to an outside VPN server I cannot get authenticated. If I try the same VPN server using a public IP behind the same context it works no problem. I know this is an issue with NAT not knowing how to get back to the 192.168.x.x address but I do not know how to resolve the issue. I am using NAT overload so I would need to get back to the address (source) without doing a 1 to 1 NAT. Any ideas? Thanks

Re: Firewall Services Mod (Transparent Mode) VPN issues

bstremp — Mon, 27 Nov 2006 20:31:14 GMT

If the NAT works fine VPN needs to work.Make sure when the packet goes out it gets a public ip address from the NAT configuration.Because private internet address do not have routing in the internet.

Re: Firewall Services Mod (Transparent Mode) VPN issues

ksudi — Tue, 28 Nov 2006 02:38:45 GMT

If you can reach the VPN server and cannot authenticated,most vpn client will fail probably because the vpn ports are taken by another vpn session or the NAT process dynamic port assignment is conflict with ports required to a vpn tunnel. A one to one static NAT should solve this issue.

Thanks

Karar

Re: Firewall Services Mod (Transparent Mode) VPN issues

Fernando_Meza — Tue, 28 Nov 2006 03:44:25 GMT

Hi .. when trying to stablish a VPN from behind a device which does NAT /PAT you need to enable nat traversal on the device terminating the VPN in this case the VPN server. Also the VPN client needs to be configured for NAT-transparency .. on cisco clients this is normally done by encapsulating ESP on UDP 4500 .. This allows the NAT /PAT otherwise you will have problems mainly because ESP and NAT/PAT are not compatible. You also need to make sure that UDP 4500 and UDP 500 can traverse the device doing NAT/PAT by checking the access lists aplpied to it.

I hope it helps .. please rate if it does.

Re: Firewall Services Mod (Transparent Mode) VPN issues

jbanker — Tue, 28 Nov 2006 16:28:15 GMT

Thanks for the info! The VPN Server we are currently connecting to uses PPTP. I can reach the VPN Server but not authenticate. I will contact the owner and see if Nat-T is setup on his end. Thanks