How do I allow IPsec through Cisco ASA 5505

[kepademus]

We have Cisco ASA 5505 and an internal user (behind NAT) needs to connect via VPN to an external company. I just cannot get this to work. I have enabled IPsec Pass Through from ASDM Configuration --> Firewall --> Service Policy Rules --> Edit Service Policy Rule --> Rule Actions --> tapped IPsec Pass Through

I have tried to find some info from the log but all i get is this message: IP = [remote gateway ip] Invalid  Packet Detected!"

I cant find anything that is blocked from the log.

Please help

[Jennifer Halim]

You would need to check with the remote/external VPN gateway to see if they support NAT-T (ie: encapsulating ESP packet in UDP or TCP).

Because ESP is a protocol, not a TCP or UDP ports, it will not be able to pass through a PAT device. Therefore, the VPN peer gateway needs to have NAT-T enabled so the ESP packet gets encapsulated in either UDP or TCP.

A test to see if the VPN works is to configure static 1:1 NAT for the internal host that you are testing to VPN from.

[kepademus]

Thank you Jennifer for your answer. Remote gateway doesn't support nat-t so i have to go with 1:1 nat with this.

There is one thing that I dont truly understand. With the old firewall we had the vpn was working without 1:1 nat with same remote vpn peer gateway. Nothing has changed exept old Zyxel Zywall died and it was replaced with ASA 5505...