Can't Establish Multiple VPN Sessions from the Same Segment 1

[mmathias]

We're using the Cisco VPN Client v 4.8.00.0440 to remotely connect to our Cisco PIX firewall. We can handle lots of sessions, but only one session from a single destination. This manifests itself when multiple employees are, for example, in the same hotel and try to connect simultaneously, or at another office and try to connect simultaneously.

Does anyone know how we can get multiple VPN sessions to work simultaneously with the Cisco VPN client?

Thanks in advance.

 

[JOAMON]

The only thing I can think of and have seen in the past is when hotels offer two levels of internet access. The first standard method were everyone funnels out one ip address and the more expensive premium method were you can get your own ip routeable address. This would then allow multiple connections as each person would have a different peer address.

 

[jdeisenm]

Can you duplicate this going through a SOHO router you control?

 

[mmathias]

This appears to be happening EVERYWHERE we try to use the VPN client to establish multiple, simultaneous sessions...whether it be in a hotel, home, a substantial business environment...everywhere.

Any other ideas?

 

[Zen37]

You need to NAT the addresses of the people connecting. The problem is that once the VPN gets the IP of the first one to connect, it sets up a route for that network in its routing table. If another connects from the same network, the VPN device figures that the original connection has failed and it will rewrite a new route to the new connection and kill the previous one.

If you NAT all source addresses of all your connections, then the VPN will only create routes for those addresse, not taking into consideration the actual IPs of your clients. Your connections will then become one to one. It may end up being difficult to configure, but it should work.

 

[mmathias]

Thank you. I've passed the suggestion along to my network people.

 

[mmathias]

Zen37 (or others),

Regarding the NATting of the VPN connections, I spoke with my network admin who thought it may have to be done on the client router side rather than on the host router side. Can you please clarify your comment?

If it has to be done on the client side -- and when I'm traveling I have no control over the router in the hotel, for example -- is there another way to address this situation so that multiple members of my company can use the VPN client software simultaneously?

If you're referring to the host router, apparently we are already NATing incoming traffic, so are there some specific settings we need to enable/disable or other areas in which we can look?

Regards,
Mark