Nortel Contivity VPN problem over ICS

[Stu247]

Hi,
I'm having problems using Nortel's Contivity VPN Client V04_15.06 on a laptop running W2K Pro connected via a wireless lan (peer to peer) to a desktop on XP Pro running ICS (ADSL)
When I try to connect, I get the "Checking for Banner Text" then the connection fails.
The Client runs fine on the desktop so obviously its the ICS that's not passing the VPN.
Does anybody know of a way round this ?
Thanks in advance.
Stu.

 

[ucallwa]

Stu247, This is a known issue with Nortel. If you are using a router, there is no need to use ICS, disable it and you will be able to connect. You also do not need to have ICS running with ADSL either.
As far a work around, this is done by design for security purposes.

 

[jincto]

Stu,

Nortel Networks has indicated that they are seeing this error on the 4.0 series of the Extranet Access Client connecting to a server running the 4.0 series of the Contivity Server software, when the end user is trying to connect from a machine with broadband access using a home router that is "IPSec aware". (The router opens inbound UDP 500, which IPSec uses)-outbound is typically wide open) One of the new features of the 4.0 code of the EAC and Contivity Server software is the "IPSec NAT Traversal". You also need the 4.0 EAC, as earlier versions did not support it. The new 4.0 EAC wraps the outbound packets in a UDP header, before reaching your home router so it will connect to the Contivity even if your home router is not IPSec aware. The problem arises when your server tries to display back the "Banner Text", as this is the first ESP encapsulation packet which is sent back down the tunnel. It is timing out because, to put it bluntly, it's not able to negotiate back on the random port it was initiated on from your EAC. There are several workarounds which may help.
1. Disable NAT Traversal on the Contivity, you can do this by group.
2. Open the UDP port on your home router that you have configured on the Contivity under "Services>IPSec ...NAT Traversal"
4. Disable IPSec passthru on your home router
5. Sometimes a firmware upgrade on your router may help. I use Linksys' BEFSR41 model with their latest firmware and have no problems.
6. Remove the home router from your setup
7. Use the 3.7 code from Nortel (actually, any code before the 4.0 series which did not have IPSec NAT traversal

Thanks,

jincto@rcn.com

 

[Pete999]

Did you ever get this working? I am having exactly the same problem and have followed the instructions to disable IPSEC passthrough on my router but it still isnt working. Can you let me know what you did to get it working?

Thanks

Peter