Cannot Establish VPN Tunnel behind a Firewall

[chewshk]

Hi,

I have a VPN3000 behind a firewall. I enabled the required TCP/UDP/IP ports. For dial-ups, I am able to establish the VPN tunnel. Works fine.

However, when I tried to connect from another site using broadband behind a PIX firewall, I can't establish.

Someone in this forum advised me to configure NAT-T in the VPN3000, which I did, but still, it can't work.

Another person explained that there is no way to establish a VPN tunnel behind a firewall (if I used IPSec) unless I use SSL. However, there is no SSL option in the Cisco VPN Client V.4.0(1).

Therefore, what can I do to establish the tunnel, and are there any firewall rules that I should enable at the client side?

Thank you very much.

Rgds

[sachinraja]

hello chewshk

you need to enable some rules on your client firewall (which has broadband) .. You need to open UDP 500 & UDP 4500, IP 50/51 to make this work..

once u open these, u will be able to connect to the vpn 3000.

let us know if this works...

Raj

[chewshk]

Hi Raj,

I have enabled those ports that you mentioned on the inside-to-outside interface, using the port numbers at the destination port. But it still cannot work.

When connecting to the VPN Concentrator, I didn't even get the message "Connecting to gateway x.x.x.x".

Did my firewall rules applied correctly?

Rgds

[lgijssel]

On the client, you should select "Transparent Tunneling" using tcp or udp, the default is mostly OK. You probably have done this already.

The PIX must allow IP access to the outside, not just tcp/udp.

On the VPN3000 side, you must permit vpn connections using NAT-T which I assume to be in fact Transparent Tunneling. Unfortunately I do not know how this can be achieved. On a PIX you must enter the line:

isakmp nat-traversal 20

I do not know if this is the same on the vpn3000.

Still hope to put you in the right direction.

Regards,

Leo

[chewshk]

Hi Leo,

Thanks. I tried inserting this command into the PIX but there is no such command. Is there anything else I need to enable before this command is valid?

The PIX version I'm using is 6.2(2).

Rgds