Help with SonicWall VPN client to firewall connection

[Gromit73]

I'm having some trouble with a VPN between a sonicwall tele3 and the VPN client software. The problem is as follows. Please ask if you need more info to help figure out the puzzle.

We installed the VPN client onto a windows 98 PC. The PC connects to the internet through a DSL connection. The DSL connection is through a Cisco 677 DSL router that is running NAT. The Sonicwall tele3 connects the internet through an "Efficient" Router that is NOT running NAT. The sonicwall has a public static IP address and has been configured to accept group VPN connections.

The VPN client and the sonicwall establish a dialog but seem to fail during the authentication stage: (Please note that IP's have been changed)

11/25/2002 16:01:52.304 - IKE Responder: Begin Aggressive Mode Phase 1 - -
11/25/2002 16:01:56.816 - IKE Responder: No response - remote party timeout or SA mis-match - Source:192.168.0.84, 500 - Destination:123.546.789.22, 500 - -
11/25/2002 16:01:56.848 - IKE Responder: Begin Aggressive Mode Phase 1 - -
11/25/2002 16:01:59.816 - IKE Responder: No response - remote party timeout or SA mis-match - Source:192.168.0.84, 500 - Destination:123.546.789.22, 500 - -

We are using "Pre-shared secret" for the VPN. The configuration on the VPN Client was exported/imported from the Sonicwall. I have reset the key on the client and the sonicwall just to insure that they are the same.

Could this issue have anything to do with Speedstream or Cisco DSL routers or NAT? Any input would be appreciated.

Thanks for the help.

 

[hongjo]

I'm willing to bet the problem is with NAT.
Try plugging the client directly into the DSL and test.
If it works, you know for sure it is the NAT causing the problem. NAT and IPSec do not play nice together.
Things to try ...
First, make sure that NAT-T is enabled on the Cisco and the Tele3. If the two manufacturers have implemented NAT-T in a compatible manner, this should work but from experience, I wouldn't hold my breath. VPN connections are difficult if you are using different hardware and the client side has NAT. Consider getting a Sonicwall (probably SOHO3) to replace the "Efficient" and create a tunnel between the two boxes. This will eliminate NAT as an issue and allow everyone on both networks to access the other network.

 

[ozoid]

Try turning off stealth mode on the destination box - it helped for me - it isnt meant to do this but i found it was the only way ...

 

[Gromit73]

I read that the Cisco 677's will work with VPN's but that was what caused the issue. I had to point port 500 UDP to the internal machine with the VPN software. The tunnal opened right up then. Thanks for the help.