Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

Cannot VPN to network through PIX501

I have a pix 501 at home. When I try to VPN in to our network via the VPN client I get authenticated but cannot get to our internal network. When I use my netgear router instead of the PIX I can VPN in and get to out internal network. Do I need to open some ports (if so what ports) on the PIX or Do i need to changed some configuration on the VPN client.

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: Cannot VPN to network through PIX501

The problem is the PIX doesn't support IPSec and PAT until 6.3 code coming out next year. Your VPN tunnel is built on UDP port 500 packets, which the PIX can PAT properly. After that, all your packets are ESP packets, which is IP protocol 50 which the PIX can't PAT. If you have a second IP address from your ISP you can create a static NAT translation in the PIX for your inside PC and this will work properly.

Alternatively, if your VPN client supports some sort of IPSec encapsulation in TCP or UDP packets, then use that and it'll work fine too.

2 REPLIES
Cisco Employee

Re: Cannot VPN to network through PIX501

The problem is the PIX doesn't support IPSec and PAT until 6.3 code coming out next year. Your VPN tunnel is built on UDP port 500 packets, which the PIX can PAT properly. After that, all your packets are ESP packets, which is IP protocol 50 which the PIX can't PAT. If you have a second IP address from your ISP you can create a static NAT translation in the PIX for your inside PC and this will work properly.

Alternatively, if your VPN client supports some sort of IPSec encapsulation in TCP or UDP packets, then use that and it'll work fine too.

Community Member

Re: Cannot VPN to network through PIX501

Thanks for the reply. We are actually using vpn 3015 and for the client I use vpn client 3.6.2 by cisco. I believe there is a way to encap IPSEC via tcp setting on the 3015. Let me know if I am wrong but I will take a look.

89
Views
0
Helpful
2
Replies
CreatePlease to create content