Showing results for 
Search instead for 
Did you mean: 

L2TP/IPSec VPN access through PIX


Hello, i having problem with VPN connection from a windows PC using L2TP/IPsec, i alow all necesary protocols (GRE, ESP, PPTP, UDP-500, UDP-4500 and UDP-1701) on outside interface on PIX (version 8.0(4)), i'm perfectly connect with PPTP but when i tried with L2TP the conecction can't be established, in PIX log i can see the creating session for ports 500 and 4500, on PC have and error that the server can be reach. I'm using a ISA Server cluster for VPN Server, the configuration are like follows:

PC <----> PIX <-----> MS ISA <------> LAN


PIX external IP

PIX Internal IP

ISA external IP

I'm using Static NAT for the external interface of the ISA for the VPN access with IP

What might be forgetting???

I will appretiated the help any one can provide me.

8 Replies 8


Hi Pedro

The details given looks good.. would you have the configs handy ? Just wanted to check the CLI commands that you had used ?

Just to test, were you able to create L2TP session from inside the PIX, just to make sure the server works good ? Do you see any drops on the "show log" of PIX when you initiate L2TP from outside ? sysopt commands can be useful, but thats more for traffic initiating from inside to outside.. in your case its from internet to inside right  ? Just curious, do you have any personal firewalls on your desktop ? You can also try opening ip any on the outside and test, just to test if the NAT and other stuff works good... are there any ACLs on the inside?

Thanks & Regards


Thanks for response Raj,

I attached the config of PIX, in this config you can see that I’m use tree interfaces, one for management with security 100, one DMZ between PIX and MS ISA with security 90 and the Outside with security 0.

Answering your questions, I make tests of L2TP sessions from DMZ Sub-net (Attaching PC to this Subnet) to the MS ISA Server and works perfectly, i can't see any drop packets on PIX log when initiated L2TP session from outside, like you said the traffic are initiated from outside, but to DMZ; i turn off the Windows Firewall and the Antivirus Firewall and the result is the same, i make a test open all traffic from outside (IP, TCP, UDP, ICMP) but can connect anyway; I don't have any ACL applied to inside interface.

Sorry for my English



How about opening TCP/1723?


thanks for reply, i already have allowed, can connect PPTP but NOT L2TP


In the outside ACL is open for pptp traffic destined to

Shouldn't this guy be translated (currently there is no static translation for it) and someone would be reaching him with its outside ip?

I hope it helps.


Hello, thanks for answer

The IP is an static translation from, all traffic iniciated to will be destinated to that is the IP of the MS ISA Server


I would consider removing the PAT configuration for the ISA server.  It may be conflicting with the Static NAT configuration.

global (Outside) 1 netmask

Try using a different IP number for that rather than  Allow the static nat to be the only thing using that IP number.

Hello, i make tests doing all that you said, remove the PAT configuration, asign a new IP to the NAT, but the result is the same; i atach the logs with the info tath receive from the PIX.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers