I do not understand your first point. Yes x.x.x.x is not the inside IP and is already something like 5.5.5.5

2. Are you saying I should lower the MTU on the PIX 506E to match the MTU of the 837?

regards, Mark

Hi again:

ip nat inside source static tcp 192.168.2.23 25 xxx.xxx.xxx.xxx 25 extendable

ip nat inside source static tcp 192.168.2.23 53 xxx.xxx.xxx.xxx 53 extendable

ip nat inside source static udp 192.168.2.23 53 xxx.xxx.xxx.xxx 53 extendable

ip nat inside source static tcp 192.168.2.23 80 xxx.xxx.xxx.xxx 80 extendable

ip nat inside source static tcp 192.168.2.23 443 xxx.xxx.xxx.xxx 443 extendable

ip nat inside source static tcp 192.168.2.23 1723 xxx.xxx.xxx.xxx 1723 extendable

Need to be changed to:

ip nat inside source static 192.168.2.23 xxx.xxx.xxx.xxx ( i.e NAT not PAT )

2: Maybe, first you need to change the mtu on your 837, because of ipsec and so on..

try mtu: 1400.

Then if you are initiating traffic from the office you should match the mtu on the other end. So try mtu = 1400 on both ends :)

BR,

Bjornarsb

Hi,

I do not think your solution to 1. will work. Also there is another entry

ip nat inside source static tcp 192.168.2.24 3389 xxx.xxx.xxx.xxx 3389 extendable

You have not mentioned this. Note it is for a different machine in the private network.

2. Traffic goes both ways from the office to home over the IPsec VPN. There are two interfaces on the 506E inside and outside. If I change outside to 1400 will that affect the other traffic that goes over this interface? Should I change both inside and outside to the same as the 837?

regards,

Mark

Hi,

Yes, 1 will work if you use another public entry for the last statement.

2. yes. but i don't know if you have tcp adjust mss on the PIX ? But I believe that you have path mtu discovery !

If you create a tunnel you can use:

tunnel path mtu discovery on the 837.

!

interface Tunnel1

ip address X 255.255.0.0

ip mtu 1400

ip tcp adjust-mss 1400

no ip split-horizon

tunnel source Dialer 1

tunnel destination X

tunnel key XXX

tunnel path-mtu-discovery

!

BR,

Bjornarsb

I will give it a try in the morning.

can you clarify your statement

Yes, 1 will work if you use another public entry for the last statement.

So I have two entries, one for the 192.168.2.23 and one that is for one port on the 192.168.2.24

I do not think this will work, I have read that your suggested solution is for all ports. I still think my problem is access-list related, but I will give anything a go now.

regards, Mark

Hi,

the problem is that you probarly only have one IP

(negotiated) so its best to move the 3389 service from 192.168.2.24 to 192.168.2.23

And you also need to use:

ip nat inside source static 192.168.2.23 interface Dialer1

If you get different IP (long term)

you have to use Dyndns too.

or try this:

!

interface Dialer1

ip address negotiated previous

encapsulation ppp

!

BR,

Bjornarsb

cannot move the 3389 to 2.23

thus herein lies the problem.

I have been told it will work, the question is how. When I try to connect to a port from outside I get asked for username, password, on port 80 and then it says it is the http server on the 837. This is why I think it is an access-list issue.

Any ideas appreciated.

regards, Mark

Try:

no ip http authentication then you

will get access to the router web configuration.

port 80 forwarding to your server on inside does not work because of my first post :)

actually you should use :

ip http secure-server and use https.

BR,

Bjornarsb