Vpn host denies Nat'ed address

[J00kie]

Seams like BCE Emergis doesn't like vpn connections from nat'ed address.
I have an internal machines using builtin W2k3 vpn client to pass through to specific other companies. (working with basic entries/ pptp udp 500 ike ah esp)
BCE denies on user Verification from internal machine cause it see's "External Address (the Nat'ed translation)" not "internal" when trying to authenticate.
I guess the VPN client is passing its internal address to BCE Host and thus refuses verification because it sees a different nat address.
Any thing would help.
So far i added udp500 50/51 tcp 45000 tcp 10000 264out 256out still nothing.

 

[marsmann]

sometimes using udp helps but it looks like you were doing this already.

another way around this is if you have any extra public IP's available you can do a static NAT translation for your PC on the inside network going out with the vpn client.

I don't know how many internal users have vpn clients going out though so if it's more than a few this may not help as you most likely don't own your own class c of public addresses!

 

[J00kie]

Additional info
pix 6.3(3) What i've added
* means others scenarios to other hosts work with only these entries no others needed.
extra fixup protocol pptp 1723
extra access-list incoming-list permit tcp any host 211.my-pubIP eq isakmp
* access-list incoming-list permit gre host 199.External host 211.my-pubIP

* access-list from-inside permit gre host 192.internal host 199.External
* access-list from-inside permit tcp host 192.internal host 199.External eq pptp
extra access-list from-inside permit udp host 192.internal host 199.External eq isakmp
extra access-list from-inside permit ip host 192.internal any
* static (inside,outside) 211.my-pubIP 192.internal netmask 255.255.255.255 0 0


"Report LOG System0.Info 192.logger %PIX-6-302017: Built outbound GRE connection 11366769 from inside:192.internalmachine (211mypubIP) to outside:199.External/1723+16384+4855 (199.External/1723+16384+4855)"
I get as far as "verify username pass" then disconnects. (i confirmed username/pass with host)