Who can confirm if VPN with Nat/Pat is working with PIX fireall or not?

david.xu · ‎01-20-2003

I read many post here about the transparent VPN, PC with NAT/PAT through VPN. I saw most people said if client with a private IP address and nated/pated, then connect to PIX by IPSEC VPN, it won't work, only VPN concentrator working with this transaparent VPN.

But as I tested , I use cisco vpn client 3, PIX firewall, cisco router with NAT, it is working fine, no problem. I only tried on VPN cleint through nat and vpn to pix, not sure if there are over 1 vpn client connect pix by PAT with same ip address, what will happen.

Is there anyone can confirm if VPN with NAT/PAT working with pix?

Thanks,

David

Nick.liang · ‎01-21-2003

if you try the secondary vpn client , the first one will disconnected

you must change pix instead of concentrator ( ipsec nat transparency )

or router with IOS support "ipsec nat transparency "

ovt · ‎01-21-2003

PIX will probably support NAT-T (IpSec/UDP) in the 6.3 release and PAT

will work with multiple clients.

Oleg Tipisov,

REDCENTER

ANGELO DE MASI · ‎01-31-2003

Hi,

do u mean that PIX 525 rel. 6.1 doesn't support NAT trasparency/ transparent tunnelling at all?

I'm trying to connect VPN Clinet 3.6.3 behind a cisco NAT/PAT router to a central PIX 525 and it doesn't work ! So I have no chances to make it working?

I can't enable tranparent tunneling on my PIX, is it true?

thanks in advance fro your reply

bye angelo

david.xu · ‎01-31-2003

Hi, Angelo

I just finish a PIX515, with version6.1 . I can connect VPN client 3.6 from my office behind a cisco router NAT/PAT with no problem to PIX. Let me know how you configure the vpn in PIX. As I know Cisco vpn client is using group 2, not group 1, that's the problem I figure out before.

David

daniel.kline · ‎02-04-2003

I believe the VPN client will work through NAT/PAt if you select IPSec over TCP/UDP.

ajagadee · ‎01-31-2003

Hi,

Yes, you are right!! As of today, the pix does not support NAT Transparency and Pix 6.3 version will have the support for IPSec Over UDP.

BTW, 6.3 should be tentatively out sometime around March/April.

Regards,

Arul