Solved: Re: Cannot VPN to network through PIX501

gaban · ‎11-25-2002

I have a pix 501 at home. When I try to VPN in to our network via the VPN client I get authenticated but cannot get to our internal network. When I use my netgear router instead of the PIX I can VPN in and get to out internal network. Do I need to open some ports (if so what ports) on the PIX or Do i need to changed some configuration on the VPN client.

gfullage · ‎11-25-2002

The problem is the PIX doesn't support IPSec and PAT until 6.3 code coming out next year. Your VPN tunnel is built on UDP port 500 packets, which the PIX can PAT properly. After that, all your packets are ESP packets, which is IP protocol 50 which the PIX can't PAT. If you have a second IP address from your ISP you can create a static NAT translation in the PIX for your inside PC and this will work properly.

Alternatively, if your VPN client supports some sort of IPSec encapsulation in TCP or UDP packets, then use that and it'll work fine too.

View solution in original post

gfullage · ‎11-25-2002

The problem is the PIX doesn't support IPSec and PAT until 6.3 code coming out next year. Your VPN tunnel is built on UDP port 500 packets, which the PIX can PAT properly. After that, all your packets are ESP packets, which is IP protocol 50 which the PIX can't PAT. If you have a second IP address from your ISP you can create a static NAT translation in the PIX for your inside PC and this will work properly.

Alternatively, if your VPN client supports some sort of IPSec encapsulation in TCP or UDP packets, then use that and it'll work fine too.

gaban · ‎11-25-2002

Thanks for the reply. We are actually using vpn 3015 and for the client I use vpn client 3.6.2 by cisco. I believe there is a way to encap IPSEC via tcp setting on the 3015. Let me know if I am wrong but I will take a look.