Pix 515 and VPN Client 3 behind firewall using PAT 1

[danhand]

hi hope you have some ideas here.
I have just upgraded our pix to version 6.01 and have got the new vpn client 3 working.
all is fine unless the client when it is located behind a router at home that uses PAT as it only has one ip address. i have checked the box on ther client that says use NAT but i feel that i need to action something on the pix.
do i need to allow port a port for esp ?

any comments will be gratefully recieved
dan

 

[Bluecrack]

We also have a PIX 515 running version 6.01 and we are also using the VPN 3.0 client. I have many users successfully using the VPN 3.0 client behind PAT firewalls, particularly ones on cable modems and DSL. If the VPN client works when it is not behind the client side firewall, I would assume the PIX config is correct.

My guess is the problem is on the client side firewall or between the client side and the PIX. I have hear of some ISPs blocking VPN traffic: ESP, AH, isakmp.

What type of firewall is on the client side?
Does the client work from that location if the firewall is not running or if it is completely open?

 

[danhand]

My set up is a w2k server with nat for the inside network. the outside is a cable modem with dhcp addressing. the firewall is zonealarm pro.
the client is installed on a w2k machine on the inside. if i disconnect the server and place the client machine on the cable modem all works fine.
i also have a collegue who has a zxyle isdn router acting as nat for his internal network. he has a fixed ip address and the client is running on nt4 server.
i am using the vpn group command for authentication on the pix.
when debugging i have noticed that the pix recives the first isakmp request and checks it against the policies when it does the match and responds nothing happens.
i feel it is a checksum/port problem but can't find a way to turn off the checksum.
any ideas

 

[Bluecrack]

Actually, one of the guys I work with had the same problem withe a Windows 2000 server doing NAT. I do not recall how he got around it. I will check with him about his solution. Also, most of my clients have hardware based routers between their clients and their dsl/cable connection.

You can enable debugging (debug crypto ipsec + debug crypto isakmp) on the PIX and see what happens when the client connects. That may reveal more information.

You may also try using something other than Windows 2000 NAT, Winroute will probably do it just fine.

Jason

 

[Bluecrack]

Forgot to mention the client log. On the client there is a Log Viewer application. You can change the filter to high for each item and then start capturing before you connect to the PIX. This will give you details on the connection from the client side.

Jason

 

[danhand]

winroute works fine (bit of tweeking on w2k).
i had been looking at the pix and client logs and could see the initial authentication but one isakmp had finished and ipsec was intoduced it failed. on the pix it got as far as the first "ISAKMP (0): atts are acceptable. Nextpayload is 0".
my next problem is that some users currently have zyxle isdn routers that don't understand protocol 50 so are no good, and don't want a pc as a gateway as "it is much larger and not as pretty". any ideas of isdn routers that may do the job. i have spoken to zyxle and the next frimware for their 202 may have the functionality but doesn't currently do so.

 

[Bluecrack]

I'm glad to hear Winroute is working. I guess Windows 2000 doesn't really support the full range of protocols it should.

About the zyxle routers, I don't have much experience with ISDN routers. I recently purchased a Wireless Cable router from DLink and I am able to run my VPN client behind it just fine. Perhaps they may have an ISDN router that will work. Another approach may be to just install a personal firewall on the home computer and have the ISDN terminate directly into the computer.

Sorry I could not be more help.

 

[danhand]

don't worry your help has been just the stepping stone i needed. i shall look about for am isdn router and feed back to the forum
thanks again
dan