Problem with Cisco VPN behind an IOS firewall

[alalli]

Good Day,

I have a Cisco VPN client that is connecting to a PIX firewall via IPSec using ESP in tunnel mode.

The client PC is being PAT to the outside interface IP address assigned by the Internet Provider.

The VPN tunnel connects first time every-time.

The problem is that, initially, we are not able to use the SAP R/3 application over the VPN tunnel.

If we run a ping first, usually the ping will timeout, but will then succeed.

After that, the SAP R/3 application works fine.

any ideas or help is gratefully appreciated,

regards,

alalli@iinet.net.au

amanda@moncrieff.com.au

[ehirsel]

I assume that this is your topology:

Client --- IOS FW --- Inet --- PIX --- SAP Server

Is that correct?

What parameters did you run with the ping command? Or did you just run ping with no parms?

I suspect that path mtu discovery may have a role in this. At the vpn client, run the set mtu utility and set the virtual adapter to an mtu of 1300, and set the phy adapter to 1400 and then see if you can connect to the SAP without running the ping command first.

Let me know how it proceeds.

[alalli]

Hi and Thanks very much :)

I did not run any parameters with the ping.

It simply timed out and then we were able to ping again and it worked.

In the end, the folks at the distant end PIX set ISAKMP NAT-T.

I had thought this was done before we ever got started, but apparently it was not.

As to the MTU, hmmm.... i had better remember that as something to check .... thanks very much :)

[pkapoor]

Did you try connecting with the SAP only once before running the ping? If not, then try connecting twice. It could be that because the IPSec SA is not established the first time, the first attempt of the SAP application times out......maybe the second one will connect.

[alalli]

Hi, and thank you for taking the time to give me that suggestion.

Trouble is that the issue seems to have been resolved by a configuration change on the PIX at the remote end. Apparently the connections are now seemless and word everytime.

I would have liked to have a little more time with the equipment, but it has all gone back into production.

thanks very much for your answer because it makes sence and i will look to try it the next time...