VPN Clinet Question

[TheStressFactor]

Hello all,

this weekend I took my laptop home which has the vpn 4.0 client from cisco. My home desktop also has it as well. I have a linksys router at home which I plug my laptop into and my desktop is also in as well. For some reason I cannot have both connected to the vpn at once. When one is connected and I try to connect from the other it discontinues the original one.

For example,

Desktop is Connected to VPN.

I go to connect to VPN with Laptop and it CONNECTS.

On the Desktop I get a message that says: Disconnected from VPN as requested by remote peer.

Any help, suggestions, or advice would be greatly appreciated.

Thank you.

Patrick

 

[tbissett]

A pretty typical issue. IPSEC was not designed to work with NAT devices, which is essentially what your LinkSys router is. The end result is what you see. Only one IPSEC session from the inside at a time.

I don't know much about the linksys router, but there may be an option on it to assist with IPSEC connections (sometimes called NAT pass-through, or the equivalent). We have a Cisco VPN concentrator, so we got around it by enabling the concentrator's IPSEC-over-TCP option, which encapuslates IPSEC within TCP packets. I do not believe that is an option on the PIX, however.

 

[TheStressFactor]

Tbisset...thank you so much for your help..sorry for my ignorance but what is the purpose of a vpn concentrator? would it be beneficial to purchase one for instances as such?

Patrick

 

[tbissett]

A VPN concentrator is a device dedicated specifically to serving VPN connections. If you have more than a handful of remote access users, it's the better way to go than setting VPNs up through the PIX. The one caveat to using a concentrator, though, is that it is NOT a firewall, but instead should be protected by a firewall, so your security infrastrucutre gets a little more complicated. Nonetheless, it's is far easier to manage VPN connections on a concentrator than a PIX.

That said, we still use our PIX 535 for site-to-site VPN connections and our VPN concentrator for remote access VPN connections (i.e. the VPN client). Just a personal preference to use the PIX for site-to-sites.

Follow the link to Cisco's product pages on VPN concentrators, and no, I'm not a cisco sales guy

http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/index.html

 

[azstyx]

Hello,
You are experiencing the biggest querk of the IPSEC protocol. IPSEC breaks with firewalls not using transparent NAP/PAT. The first client to enable the IPSEC connection is fine until another client tries to enable an IPSEC connection, which breaks the previous IPSEC connection. What you need to do is enable IPSEC Transparent tunneling. The Cisco VPN client 3.3+ can use two methods: IPSEC encapsulated with UDP or IPSEC encapsulated with TCP. TCP works the best but the destination VPN server has to be able to support both of these. The default ports that Cis co uses is udp/10000 and tcp/10000. The VPN3000 server supports both methods. The PIX supports UDP method but you must be using O/S v6.3 at least and enable transparnent tunneling by:
In PIX O/S v6.3+, configure:
To enable NAT traversal, enter the following command:
isakmp nat-traversal [natkeepalive]
Valid values for natkeepalive are 10 to 3600 seconds; the default is 20 seconds.

Configure the vpn client to use IPSEC over UDP.
Click on Options>Properties
check the box to enable Transparent Tunneling
check box for Use IPSEC over UDP

Here's my engineering note on this issue:
Cisco & IPSEC Transparency

By design, NAT & PAT will break the IPSEC encryption. Another issue is that multiple clients behind a firewall cannot run simultaneously because they will step on each others streams.
This is a common problem when users try to use hotel, wireless and apartment complexes with ISP connections and firewalls. There are workaround solutions available in some cases depending upon the equipment and software being deployed.

VPN 3000

The VPN3000 system has provided two workarounds to this problem.
a) In Unity Client version 3.0 – 3.2, an option called IPSEC over NAT using UDP was implemented. The default port used was upd/10000. While this option provided support for client behind a firewall perform NAT and PAT, it was not always reliable due to the nature of the UDP protocol and also depending how the firewall code has implemented NAT & PAT.
b) In Client version 3.3, a new feature was added to perform IPSEC over NAT using TCP. The default port was 10000. TCP is much more reliable than UDP and also it resolved the problem of running multiple simultaneous clients behind a firewall. (Preferrable method to use, much more reliable than UDP)

Configuring the VPN Client for IPSEC Transparency
Click on Options>Properties
check the box to enable Transparent Tunneling
check box for Use IPSEC over UDP OR use the TCP option which is more releiable when connecting to a VPN3000.



PIX & IPSEC over NAT/PAT

In PIX O/S 6.2 and earlier, has no direct support for IPSEC transparency with NAT/PAT.

In PIX O/S v6.3+, configure:
To enable NAT traversal, enter the following command:
isakmp nat-traversal [natkeepalive]
Valid values for natkeepalive are 10 to 3600 seconds; the default is 20 seconds.

Configure the vpn client to use IPSEC over UDP.
Click on Options>Properties
check the box to enable Transparent Tunneling
check box for Use IPSEC over UDP



As of PIX 6.3, IPSEC can be implemented over NAT/PAT just like on the VPN3000.
PIX refers to it as VPN NAT Traversal.
This feature extends support for site-to-site and remote access IPSec-based VPNs to network environments that implement Network Address Translation (NAT) or Port Address Translation (PAT), such as airports, hotels, wireless hot spots, and broadband environments
This feature is added to the isakmp nat-traversal command in PIX Firewall Version 6.3 software. To configure this command, refer to "Using NAT Traversal" in the Cisco PIX Firewall and VPN Configuration Guide. For a complete description of the command syntax for this new command, refer to the Cisco PIX Firewall Command Reference.
Using NAT Traversal
Network Address Translation (NAT) and Port Address Translation (PAT) are implemented in many networks where IPSec is also used, but the a number of incompatibilities that prevent IPSec packets from successfully traversing a NAT device.
PIX Firewall Version 6.3 provides a feature called "Nat Traversal," as described by Version 2 and Version 3 of the draft IETF standard, UDP Encapsulation of IPsec Packets," which is available at the following URL:

http://www.ietf.org/html.charters/ipsec-charter.html

NAT Traversal allows ESP packets to pass through one or more NAT devices. This feature is disabled by default.

Note NAT Traversal is supported for both dynamic and static crypto maps.

To enable NAT traversal, enter the following command:
isakmp nat-traversal [natkeepalive]
Valid values for natkeepalive are 10 to 3600 seconds; the default is 20 seconds.