L2TP/IPSec VPN access through PIX

Unanswered Question
Feb 12th, 2010

Hello, i having problem with VPN connection from a windows PC using L2TP/IPsec, i alow all necesary protocols (GRE, ESP, PPTP, UDP-500, UDP-4500 and UDP-1701) on outside interface on PIX (version 8.0(4)), i'm perfectly connect with PPTP but when i tried with L2TP the conecction can't be established, in PIX log i can see the creating session for ports 500 and 4500, on PC have and error that the server can be reach. I'm using a ISA Server cluster for VPN Server, the configuration are like follows:

PC <----> PIX <-----> MS ISA <------> LAN


PIX external IP

PIX Internal IP

ISA external IP

I'm using Static NAT for the external interface of the ISA for the VPN access with IP

What might be forgetting???

I will appretiated the help any one can provide me.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
sachinraja Fri, 02/12/2010 - 14:25

Hi Pedro

The details given looks good.. would you have the configs handy ? Just wanted to check the CLI commands that you had used ?

Just to test, were you able to create L2TP session from inside the PIX, just to make sure the server works good ? Do you see any drops on the "show log" of PIX when you initiate L2TP from outside ? sysopt commands can be useful, but thats more for traffic initiating from inside to outside.. in your case its from internet to inside right  ? Just curious, do you have any personal firewalls on your desktop ? You can also try opening ip any on the outside and test, just to test if the NAT and other stuff works good... are there any ACLs on the inside?

Thanks & Regards


pedrosuero Mon, 02/15/2010 - 13:25

Thanks for response Raj,

I attached the config of PIX, in this config you can see that I’m use tree interfaces, one for management with security 100, one DMZ between PIX and MS ISA with security 90 and the Outside with security 0.

Answering your questions, I make tests of L2TP sessions from DMZ Sub-net (Attaching PC to this Subnet) to the MS ISA Server and works perfectly, i can't see any drop packets on PIX log when initiated L2TP session from outside, like you said the traffic are initiated from outside, but to DMZ; i turn off the Windows Firewall and the Antivirus Firewall and the result is the same, i make a test open all traffic from outside (IP, TCP, UDP, ICMP) but can connect anyway; I don't have any ACL applied to inside interface.

Sorry for my English


pedrosuero Mon, 02/15/2010 - 13:28

/* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-qformat:yes; mso-style-parent:""; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin:0in; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:11.0pt; font-family:"Calibri","sans-serif"; mso-ascii-font-family:Calibri; mso-ascii-theme-font:minor-latin; mso-fareast-font-family:"Times New Roman"; mso-fareast-theme-font:minor-fareast; mso-hansi-font-family:Calibri; mso-hansi-theme-font:minor-latin;}


thanks for reply, i already have allowed, can connect PPTP but NOT L2TP


Panos Kampanakis Mon, 02/15/2010 - 13:32

In the outside ACL is open for pptp traffic destined to

Shouldn't this guy be translated (currently there is no static translation for it) and someone would be reaching him with its outside ip?

I hope it helps.


pedrosuero Mon, 02/15/2010 - 15:17

Hello, thanks for answer

The IP is an static translation from, all traffic iniciated to will be destinated to that is the IP of the MS ISA Server


pedrosuero Tue, 02/16/2010 - 12:00
Hello, i make tests doing all that you said, remove the PAT configuration, asign a new IP to the NAT, but the result is the same; i atach the logs with the info tath receive from the PIX.



This Discussion