Can't run Mobile VPN client from behind a firewall

[BigFinn]

I need to connect to our PIX at work via VPN client. This works fine when my PC is connected directly to the Internet (cable modem), but refuses to work when my PIX at home is set up in between the client PC and the cable modem.

When VPNing 'through' the PIX, the VPN client comes up, the padlock closes and DPD keepalives travel back and forth up the tunnel (I can see them in the logs). It appears to be working correctly.

I can also see the change in my client PC when the VPN client starts up (I get an IP address for the CISCO VPN adapter, the VPN group WINS server IP address is configured) but I cannot send any traffic to the LAN at work. I can't ping anything, not even the WINS server I can see dynamically configured in the IP properties on the client PC.

Has anyone had similar experience?

Kind Regards

BF

 

[bytehd]

http://www.tek-tips.com/faqs.cfm?fid=5415

you need a few PIX commands and use the UDP/4500 choice
on the Cisco VPN Windows Client.

Do the statistics show any RETURNED packets?

http://www.insyncva.com

 

[308win]

You probably do need NAT traversal. Another problem could be that you are using the same IP address range at work and at home, that will cause problems also.

Look in status-statistics-route details on your VPN client, are the remote LANs there?

 

[bytehd]

Actually, the stats route details always shows 0.0.0.0 when im connected.

Its the sho isakmp or sho crypto sa PIX commands that help diagnose the tunnels.

(Get connected to the PIX via SSH first)

http://www.insyncva.com

 

[NickDJ]

I had similar problem
isakmp nat-traversal 20 on the PIX did solve problem,
and you need to open udp/4500 port on the gateway to Internet.

Hope it would help.

 

[BigFinn]

Hi NickDJ, others,

thanks for the answers.

Does that udp/4500 port need to be opened on the PIX at the corporate LAN where I'm trying to connect to, or on my PIX standing in the way?

BF

 

[bytehd]

sysopt connection permit-isakmp" does it for the pix
other routers in front may need an ACL
or a simple "IPSec passthrough" selection for you

http://www.insyncva.com

 

[bytehd]

i meant "sysopt connection permit-ipsec"

http://www.insyncva.com