RV325 IPSec VPN Site-to-Site and L2TP

[barnes.greg]

Hi, I have 3 sites, head office and 2 branch offices all with RV325's. site-to-site VPN configured between all sites.

We've recently needed to try and implement L2TP in place of PPTP, (thanks apple) at the head office with preshared key, but as soon as we put in the port forwards to the RAS server, the VPN's fail to connect. Or one branch VPN connects and the other fails. The logs in the RV325 don't indicate anything, other than maybe [Tunnel Disconnected] I suspect because we have to forward IPsec UDP 500 as once removed things return to normal.

Current firmware is 1.3.2.20

Any and all assistance appreciated.

Thanks

Greg

[Georg Pauwen]

Hello Greg,

I assume the L2TP connection is between (Apple) end hosts ? Do you have L2TP Passthrough enabled (VPN --> VPN Passthrough --> L2TP Passthrough) ?

[barnes.greg]

Hi Georg,

Yes the L2TP connection is for end hosts ("i" devices or laptops on hotspot due to the ios 10 removing and blocking PPTP)
Passthrough is enabled, (L2TP, IPSec and PPTP)
Thanks, Greg

[Georg Pauwen]

Hello Greg,

to be honest I am not sure about how Apple implements L2TP, but normally you would need to port forward UDP 500, 4500, and 1701.

[barnes.greg]

Thanks Georg, that is correct those ports need to be forwarded, and work for the L2TP endpoints. But once those port forwards are in I get unusual and unpredictable behaviour on the site-to-site IPsec VPN's for the branches. Ta Greg

[Georg Pauwen]

Greg, sorry for the confusion: you are saying when you remove port forwarding, both  the site to site VPNs as well as the L2TP client connections do work ?

I researched the documentation, and according to Ciscp, no port forwarding at all is necessary for passthrough to work...

[barnes.greg]

Thats OK Georg, may have been my explanation.

Without the port forwards, L2TP connection from endpoints does not work.
Without the port forward how would the router know where to send the L2TP traffic to our RAS server for the connections?

the site-to-site VPN's work fine without the port forwards, as they are terminated by the RV325

Thanks Greg.

[Georg Pauwen]

Greg,

so apparently something is messing with the IPSec site to site VPN when port forwarding is enabled. I have looked through the docs, but there are no other options when it comes to configuring passthrough. Do you have NAT Traversal enabled on both sides (VPN --> Gateway to Gateway --> Advanced Settings) ?

I have come across a few cases where the firmware causes issues, if possible, try downgrading to 1.2.1.14...

[barnes.greg]

It would seem, i will experiment with the NAT Traversal on the VPN after-hours when i can, as this is currently not enabled.

Not sure a firmware downgrade is an option, but will give it thought if needed.

Thanks Georg.

[Georg Pauwen]

Hello Greg,

in the meantime, I'll check if  macOS throws something in there that causes the VPN to get disrupted. Which version are your clients running, 10.12.2 ?

[barnes.greg]

Varies on 10.x and above. Typically these are iPads and iPhones used to hotpsot.

NAT-T has had no positive effect.

Thanks Greg

[Georg Pauwen]

Greg,

there are not many options to configure on the iPad/iPhone end I guess.

If possible, try and disable the Firewall on the RV325 (Firewall --> General). If that makes a difference, we need to find out which rule in there causes the problem.

[garry.holmberg1]

Had a similar experience when migrating from old Sonicwall to RV320.  There was an existing Verizon Cellular extender appliance which required port 500 among others to be forwarded to the extender appliance.  Later we had a need to implement site to site IPSec tunnel.  Tunnel could be established but pings only worked in one direction (from site with Verizon extender to HQ).  As soon as we disabled port forwarding on port 500 the tunnel worked in both directions.

Port 500 is identified in the RV320 as IPSEC, so that was the one and only port we disabled and fortunately that worked.

I would contact Cisco small bus tech support if the issue hasn't been resolved.  

If it has been resolved would be very interested in fix.