IPSec over TCP vs IPSec over UDP

[v.chow]

In my VPN Client 3.6.1, IPSec over TCP with port 80 works behind a PIX firewall using PAT but not works if I connect to Internet directly with Public address from ISP. Why?

IPSec over UDP with default port 10000 works for Internet with Public address from ISP but not works behind a PIX Firewall. Why?

Which method can cater both situation so that there is less interruption on the client? ie. Public address from ISP and private address behind a PAT Firewall.

[afakhan]

Hi,

First scenario:

It could be due to your ISP doing some caching on TCP80 (WWW) port, esp. happens if you are using dial-up account, you should be using any port other than TCP80.

Second scenario:

For IPsec/udp you need to open up IPsec/UDP (port configured) on the PIX FW, and UDP500 (ISAKMP) port as well, but if you are trying to use more than one client behind the PIX at the same time, then IPSec/UDP is not a solution for you, use IPsec/TCP instead.

Thanks,

Afaq

[engel]

Hi Afaq,

Is the PIX not capable to allow several VPN clients using "IPSec over UDP" to create a VPN tunnel ??

That different with my test result here, a PIX doing NAT or PAT does able to allow multiple VPN remote clients to terminate VPN tunnels to the Concentrator.

[enock_moubongo]

Hi ,

I have a problem with VPN client!

I can't open several ipsec tunnel at the same time.

When i open a second tunnel, the first one is dropped with : "The remote peer has terminated your VPN connection"

Remote peer is a pix and VPN clients are on a LAN behind a router!

LAN-------router----------------pix

When doing IPSEC over TCP nothing works

What's wrong

[kdurrett]

Sounds like a NAT/PAT issue. Are you doing PAT for your clients on the router? You will need to have static 1-to1 NAT translations. IPSEC over tcp isnt a feature that works to the pix, only to a 3000 concentrator. That should be up and coming when 6.3 is released, talk to you local account manager on details of that. But until then, when connecting to the pix you will need to do a 1-to-1 static NAT translation.

Kurtis Durrett

[enock_moubongo]

Hi Afaq,

here is my design :

Vpn client 1|----------router(PAT)----------PIX

|

Vpn client 2|

It is impossible for me to run two Vpn clients at the same time over udp.

Router has only one IP address from ISP so i do PAT.

Why cannot i run several Vpn client behind router ?

I tried IPSEC/TCP but it does not work.

I create an access-list with TCP port 10000 on PIX but nothing happened.

Is IPSEC/TCP supported on PIX ?

Regards,

[kdurrett]

Currently only the vpn3000 concentrators support ipsec over tcp/udp. You will need to have a static address for each client behind your router pat device to connect to the pix. If your running 12.2.5T you can set up a one to one esp nat translation that will allow one of your 2 clients to connect to the pix without the additional public ip's.

Kurtis Durrett

[enock_moubongo]

Thanks very much for information!