isakmp nat-traversal 20 does not work

[jemorris73]

I've enable isakmp nat-traversal 20 on a PIX 525 ver. 6.3 to allow multiple VPN connections from a site that is doing NAT. I'm doing NAT on the home site. One computer can connect but I'm still having problems with more than one computer connecting to the home site. Is there anything else that needs to be done to allow multiple connections?

[jmia]

John,

Has the remote site got NAT-T enabled as well? Can you pls post your config too - take out any sensitive info.

Jay

[jemorris73]

no option on remote site router (Netgear).

here are some lines from the config.

nat (inside) 0 10.0.0.0 255.0.0.0 0 0

static (inside,outside) STATEMENTS

conduit permit STATEMENTS

=============

sysopt connection permit-ipsec

sysopt ipsec pl-compatible

crypto ipsec transform-set md5 esp-des esp-md5-hmac

crypto dynamic-map md5 70 set transform-set md5

crypto map rtpmap 70 ipsec-isakmp dynamic md5

crypto map rtpmap client configuration address initiate

crypto map rtpmap client configuration address respond

crypto map rtpmap interface outside

isakmp enable outside

isakmp key *********** address 0.0.0.0 netmask 0.0.0.0 no-xauth no-config-mode

isakmp identity address

isakmp client configuration address-pool local dealer outside

isakmp nat-traversal 20

isakmp policy 70 authentication pre-share

isakmp policy 70 encryption des

isakmp policy 70 hash md5

isakmp policy 70 group 2

isakmp policy 70 lifetime 86400

vpngroup (VPN Group Name) idle-time 1800

vpngroup (VPN Group Name) password

[sachinraja]

Hello Morris,

Nat-t is required only at the destination.. u dont need at the source.. anyway, if one user is able to connect, therez no problem with the configuration of the destination.. are u gettin any debug messages when the second user fails to connect ?? not really sure about netgear, but in pix, there are no commands which will limit NAT-T connections onto it...

get us some debugs if possible..

Raj