VPN Client and ISA Server

[leopastor]

Need to know how to configure my system to allow workstations to connect to a Cisco VPN Concentrator 3005 in another location. The workstations are getting into Internet through ISA Server. Without ISA Server and when clients connect through ADSL, everything works fine.

Some documentation instructs to open ports on the proxy, but even without packet filtering or any restrictions I still could not make it work.

Thanks.

Leo Pastor

leop@satlink.com

[albadger]

Hi Leo,

This won't answer your question directly but it is food for thought....

Is the connection then established between the client and the concentrator or will it be between the ISA server and the concentrator?

As far as I am aware, the ISA server only does transport mode and it is IPSec only. I am not sure about the VPN3000 concentrator, but I believe there is incompatibility between the PIX and ISA server due to the fact that with the PIX, we can change to transport mode in version 6.x but we need to run L2TP over IPSec to utilise this. If it is not L2TP over IPSec, the packets will be disgarded. Hence, PIX to ISA is not possible.

[leopastor]

Hi, Alison. Thank you for your reply.

"Is the connection then established between the client and the concentrator or will it be between the ISA server and the concentrator? "

The connection would be established between the ISA server and the concentrator, since ISA server is the "owner" of the connection to Internet. The client would have to pass through ISA server which, as I pointed out before, is allowing (at least is should!) to pass anything during the testing phase.

"As far as I am aware, the ISA server only does transport mode and it is IPSec only. "

In my understanding ISA server supports both IPSec and L2TP in full. I will check this, anyway.

I appreciate very much your reply. As you said, it is food for thought. If it comes that you have more food of this kind, please let me know.

Regards.

Leo Pastor