Checkpoint VPN client behind 1800 running CBAC

[rasoftware]

Anyone got problems running R56 Securemote client behind an IOS router running CBAC firefall features?

I have a client running unreliable behind it.

[r-simpson]

What CBAC features have you enabled on the IOS router? What kind of problems do you encounter?

[rasoftware]

It appear the client R56 remain "up" but data stops flowing. I have CBACB on inside interface "in" with TCP, UDP, ISAKMP and most INSPECTs set.

I have found interestingly that this client uses a fixed source port and also 2746 for UDP encap and not NAT-T standard 4500 UDP.

I have run a later client R60 over a PIX and it works well.

Cisco tell me the fixed source port used to cause problems in their client and they changed it. I also wonder why Checkpoint have changed the encapsulation UDP port to 4500???