Internet Connection Sharing-securemote client to Checkpoint1 Firewall

[dmna007]

Hi Everyone.

Have set up a network at home with a pc plugged into the adsl set up as a ICS server so the other systems (all windows 2000) can access the internet.

This side of things works fine with all systems able to connect to the web.

I am trying to connect to my works vpn via a system on the home network going through the ICS server but cannot connect.

When I am plugged in directly to the adsl I CAN connect to the vpn without a problem, but when using ICS this doesnt work.

Is there any reason why this would be the case, I didnt think ICS did any packet filtering unless you specified it to?

Can anyone be of any help?

Thanks, Damien

 

[dmna007]

Hi does anyone know why i am having these problems using ICS?

Thanks

Damien

 

[Belushi]

When you are using ICS I assume you have NAT enabled to create a home network. Does this home network's subnet coincide with a subnet on on your business side? If so, you'll need to assign your home network a completely different subnet.

Also NAT can break IPSEC protocol often used with VPN. You will need to use ESP with IPSEC to make this work right behind a NATed device. Ask your Network guys what you are doing with your Securemote.

When you are plugged directly into your ADSL line and can get the VPN to work, chances are your PC gets the public IP address and no NAT is taking place. This is why you work in thsi scenario.

 

[dmna007]

Hi Belushi thanks for your responce.

How can NAT be enabled on ICS, is this a registry key or a change of the securemote ini file?

The subnet masks are completely different for the home network and work networks so i dont think this will cause a problem.

We are also using fwz encryption should this make a difference?

 

[Belushi]

I'm not too farmiliar with ICS because I have always preferred the router solution instead.

When you use ICS, does your host PC (the one directly attached to the broadband modem) act as a DHCP server and dish out IP addresses to the other PCs or is some other scheme used?

I use IKE with Securemote. I seem to remember a lot of people having issues with FWZ. You'll need your network guys to make sure you are both using the same ecryption shemes. I believe FWZ is proprietary to Checkpoint where as IKE is an industry standard.

 

[dmna007]

Thanks Belushi.

Does anyone know any switches, setting or registry keys for ICS to enable/modify NAT settings or IP encapsulation?

We are using static IP addresses on all of our hosts but can try dhcp but not sure this will make a difference?

Are there any products for internet connection sharing/proxies that will definately work with secure remote for all home users?

Thanks, Damien.

 

[dmna007]

Hi Guys, anyone know about enabling NAT using windows 2000 internet connection sharing?

Thanks

Damien