08-12-2005 07:50 AM - edited 02-21-2020 12:19 AM
I have setup VPN client access to my PIX 515 running version 6.2 (1), now my problem is as follows:
When I use a PSTN dial-up connection from my laptop and then run the VPN client, I can connect to my PIX no problem and also can access the internal network. But when I try to connect to the PIX using the same VPN client from behind another PIX (running version 6.3(4)) I can not connect, I get a peer not responding message on the VPN client.
Can someone please explain what I am missing here, or do I need to enable some command on the PIX which is running 6.2(1) code??
I have NAT-T enabled on my PIX with 6.3(4) code but can not find any references to NAT-T for PIX with 6.2(1) code!! could this be the problem, if so is there any solutions?
PS. I am using VPN client version 4.0.1 (Rel)
I really need this up and running ASAP so any help will be much appreciated also, I can not upgrade the 515 to 6.3(4) as customer does not want to!!!
Many thanks for you assistance.
08-15-2005 08:08 PM
Sorry for the delay in responding.
For NAT-T to work properly you need to define it on the PIX that you're connecting to, which would be the one running 6.2(1). Unfortunately, as you've figured out, NAT-T was not supported in 6.2 code.
What you can do is allow the PIX you're going thru (the one running 6.3(4)) to properly open up holes for the ESP traffic, then you shouldn't need to change anything on the 6.2(1) PIX. The following command on the 6.3(4) PIX will do that for you:
fixup protocol esp-ike
08-15-2005 09:28 PM
In this case we can have just one ESP connection through the 6.3(4) PIX at a time, does it true?
08-15-2005 11:23 PM
Glenn - many thanks for your response, when I tried to configure the fixup for esp-ike on the PIX that is running 6.3(4), I got the following message:
FW_1_UK(config)# fixup protocol esp-ike
PAT for ESP cannot be enabled since ISAKMP is enabled. Please correct your configuration
and re-issue the command!
I do have several site-to-site VPN tunnels terminating on this firewall, is there anything I could setup on the PIX that is running 6.2(1) or even the 6.3(4)??
Many thanks for your suggestions/help.
08-15-2005 11:34 PM
"However, because ESP packets do not identify the ports that are involved, PAT is performed by assigning port 0 (zero). Only one ESP tunnel is supported at a time. Also, when the PIX Firewall has this feature enabled, it cannot terminate VPN tunnels in relation to other IPSec peers"
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/config/fixup.htm#wp1094669
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide