isakmp nat-traversal doesn't work

[NickDJ]

Hello,

Our VPN client is behid PIX 515 firewall, we want to connect to our customer network through VPN tunnel to other PIX 515. VPN works from dial-up no problem.
Everywhere I looked, it was advised to use nat-t, but if I issue isakmp nat-traversal 20, or without 20 on our PIX and client PIX, or only on our or only on customer's , VPN would not work even if first establish dial-up connection,
Please help

 

[bytehd]

Our VPN client is behind PIX 515 firewall..."

Then just connect to the hosts on the other side.

http://www.insyncva.com

 

[NickDJ]

Oh yes, I could do this, and I would not ask, but then I have to put PC again back to our network, and this way several times a day. If you could not give wise advise why then you bothered.
And anyway now I just would like to know why nat-traversal doesn't work.
Thank you.

 

[bytehd]

Im sorry.
I dont think I understand the question.

http://www.insyncva.com

 

[NickDJ]

Question was:
I wanted to connect to customer's network over VPN tunnel;
Network setup:

VPN client(ver 4.0.5)--- our PIX ver 6.3(4) -- our Router --- Internet --- customer router --- customer PIX ver 6.3(1) --- customer network.
I could connect to customer's network, but could not to browse their network.
I found out about NAT-Traversal. Every one advised that it should solve problem, but it didn't do for me, until port UDP/4500 on customer's router was open. Now huray! it works.

Sorry if I was hash, I was a bit frustrated I was dealing with the problem for weeks.
Thank you for your response.
Kind regards

 

[bytehd]

our PIX 6.3(4) needs "sysopt connection permit-ipsec"
our Router needs something like "IPSec passthrough"
customer Router needs same
customer PIX 6.3(1) needs "sysopt connection permit-ipsec"

and a matching list of statements

here, easier to look at the FAQ

http://www.tek-tips.com/faqs.cfm?fid=5415

http://www.insyncva.com