Windows firewall IPSEC bypass accross remote Client VPN?

[johnstone_cisco]

Hi,

I am trying to implement IPSec Authenticated Firewall Bypass on windows vista clients within my microsoft domain to avoid implementing numerous windows firewall port exceptions for each client.

This is working internally on our network, between services servers (i.e AV server), and desktop clients. However i am having a problem when the clients are remotly accessing the domain via the VPN client.

I have open traffic ports (IKE - UDP500, ESP - IP Prot 50, AH - IP Prot 51) bidirectionally between the remote vpn clients subnet and the services servers, however when the endpoints initiate traffic to the services server, the IKE traffic is unencrypted?

Is this configuration possible, any pointers on the way forward would be great!

Thanks

Brian

[Marcin Latosiewicz]

Brian,

let me start by pointing out that typical IPsec traffic is: UDP/500 for IKE, UDP/4500 (for IKE+ Encrypted traffic) NAT-travsersal, Protocol 50 and 51 as you pointed out.

If users are remotely behind NAT they will always use UDP/4500 and UDP/500.

IKE starts to be encrypted as soon as we perform DH exchnage - i.e. from message 5.

Now how this fits into overall scenario I'm not sure :-)

Marcin