Firewall Services Mod (Transparent Mode) VPN issues

[jbanker]

I am using a FWSM in transparent mode on a 6509 and I am running into issues using the Microsoft VPN client with NAT. Currently, I have NAT setup on my router and when I try to VPN to an outside VPN server I cannot get authenticated. If I try the same VPN server using a public IP behind the same context it works no problem. I know this is an issue with NAT not knowing how to get back to the 192.168.x.x address but I do not know how to resolve the issue. I am using NAT overload so I would need to get back to the address (source) without doing a 1 to 1 NAT. Any ideas? Thanks

[bstremp]

If the NAT works fine VPN needs to work.Make sure when the packet goes out it gets a public ip address from the NAT configuration.Because private internet address do not have routing in the internet.

[ksudi]

If you can reach the VPN server and cannot authenticated,most vpn client will fail probably because the vpn ports are taken by another vpn session or the NAT process dynamic port assignment is conflict with ports required to a vpn tunnel. A one to one static NAT should solve this issue.

Thanks

Karar

[Fernando_Meza]

Hi .. when trying to stablish a VPN from behind a device which does NAT /PAT you need to enable nat traversal on the device terminating the VPN in this case the VPN server. Also the VPN client needs to be configured for NAT-transparency .. on cisco clients this is normally done by encapsulating ESP on UDP 4500 .. This allows the NAT /PAT otherwise you will have problems mainly because ESP and NAT/PAT are not compatible. You also need to make sure that UDP 4500 and UDP 500 can traverse the device doing NAT/PAT by checking the access lists aplpied to it.

I hope it helps .. please rate if it does.

[jbanker]

Thanks for the info! The VPN Server we are currently connecting to uses PPTP. I can reach the VPN Server but not authenticate. I will contact the owner and see if Nat-T is setup on his end. Thanks