Contivity VPN Traffic

[carlosmcse]

I have a Contivity 1740 with 3 PCI NIC's plus the default LAN NIC. I also have the OSPF and Statefull firewall license installed. This device was used as a site to site vpn switch. We are no longer using Site-to-Site VPN's but we still need User VPN access to our Network from anywhere. So we configured the the switch with LDAP proxy, ipsec.... etc... I can establish the connection using the VPN client and get an ip address from the client address pool configured on the contivity i also get the dns server ip's configured for the group etc.. I can ping from the client to any server/host on the internal network and vice versa. But that's all i can do only ping I can't use any other protocol. The firewall is set with an override rule to allow from any to any and all traffic. I know it's not the firewall blocking I also disabled the statefull firewall and I still have the same problem, I can only ping. Any recommendations???? Please Help.....

 

[HungryHouse]

Is it possible you have an interface filter or tunnel filter applied?
This would not be related to the Stateful Firewall but could potentially allow only PING traffic and nothing else (especially interface filters since this is a canned service thats easily selectable).
Check that and let us know.

 

[norteldude78]

Can you be more specific than "any other protocol"? I know there are issues with Kerberos and packet fragmentation on the Contivitys that can be solved by adjusting the TCP MSS value.

Do this on the private interface because VPN clients are logically attached to the private side. Go to System > LAN > Edit (Next to the IP address) and enable it first. Then lower it to 1300 or so, maybe even lower (<1000) until you can connect to some resources.


peace

 

[carlosmcse]

I tried all of the above with no luck... i'm sure i'm missing something but what? The IP addresses that I'm providing to the users is from a address pool that is not directly configured with any NIC on the contivity, I don't think this should be a problem since the contivity automatically creates the dynamic routes when a user connects. Why is that i can only ping the internal subnet? This is getting me crazy.............

 

[norteldude78]

Sounds like you need to enable client address redistribuition:

Routing > Client-addr-dis > CAR Options > Enable

If you are using OSPF on the private side, make sure you redistribute your utunnel routes into OSPF: Routing > Policy.


peace

 

[walter12]

Nortel Dude.. Kerberos is UDP TCP clamping will not help with this..

He is able to ping. Can you HTTP with IP address??

 

[carlosmcse]

I can http to the contivity but that's it. I looked at the firewall logs and nothing is being blocked. I'm about to reset this thing to defaults and try again. This contivity is not being used (for now) so I can play with it until I get it to work.. Any sugestions?