Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

CISCO VPN CLIENT(IPSec over UDP) <-> VPN Concentrator : PROBLEM


Our company managers have lap-tops with application using partner`s VPN Concentrator site (IP address, belongs to "NIKE") and should connect as our LAN internal IP addresses (CISCO VPN Client 3.5.2, IPSec over UDP, transparent tunneling) over our ISA 2000 firewall and our CISCO 805 router.

(Sorry, this should not have been advertisement, it`s just that I have had not much of support from their contacts, in fact they are not real sys.admins, and I could not get to any real VPN Concentrator admin. Besides, I hope this will make other people having had the same problem with the same side to post here their suggestions and experience).

Anyway, all they told me is: open UDP 500 and UDP 10000. I am afraid it is not that simple.

They can connect, authenticate, get address from VPN Concentrator ,but when they start using application there is no response from target server. No data ever comes inbound.

Now, I have been experimenting with our CISCO router which is behind firewall (completely public): I assigned public address to Laptop client and tested changing access-list in order to "catch" ports.

All OUTBOUND IP traffic on CISCO is permitted.

For INBOUND access list, I have put:

"permit ip any any" and THIS HELPED.

I have tried with "netstat" on client to see what IP ports are in use but haven`t discovered anything interesting, besides the fact that when application communicates remote server TCP 40400 IS ALWAYS OPENED ON REMOTE SIDE!

When I changed INBOUND access list to:

"permit udp any any

permit tcp any any" NO SUCCESS!

I tried with:

"permit ipinip any any" but NO SUCCESS!

1) Does anyone knows what ports this VPN Concentrator really uses and how to find out what specific IP protocols and ports should be opened on CISCO 805, both in and out?

2) If VPN CONCENTRATOR ( admins do not follow this forum, how to monitor ports and IP protocols in use on CISCO IOS 12.2 during succesful session which I described above? Something like "netstat" in Windows.

3) What firewalls at clients` side support this if ISA doesn`t (Win2000 environment)? Please, only confirmed through testing.




Re: CISCO VPN CLIENT(IPSec over UDP) <-> VPN Concentrator : PROB

you may try udp 4500

New Member

Re: CISCO VPN CLIENT(IPSec over UDP) <-> VPN Concentrator : PROB

I am having a similar problem. A VPN tunnel is established and all authentication works without a hitch but I cannot get to any corporate applications. For telne as an example, it seems as though SYN packets are being sent out but there is no ACK.

From this I infer that somewhere along the way it is being blocked. What options are there for debugging this?


Re: CISCO VPN CLIENT(IPSec over UDP) <-> VPN Concentrator : PROB

If you are using nat, you probably need to disable it for commo between hosts and vpn clients.

New Member

Re: CISCO VPN CLIENT(IPSec over UDP) <-> VPN Concentrator : PROB

So how exactly do you disable nat for communication between hosts and vpn clients?

New Member

Re: CISCO VPN CLIENT(IPSec over UDP) <-> VPN Concentrator : PROB

Just a thought...but I had problems with my VPN passing traffic and had a person who could login but not get into inside servers... I found that my router admins had left off some important routes...once I had routing going I was then able to pass traffic successfully. Good Luck.

New Member

Re: CISCO VPN CLIENT(IPSec over UDP) <-> VPN Concentrator : PROB

First off, I believe the Concentrator can be configured to tunnel what ever port you want. For insistance we have ours set up to tunnel all traffic through a certain UDP port. The Concetrator's profile should be imported to the users computer and everything should be gravy. As far the firewall is concerned, is there more than one way to allow ports through it? I only ask this b/c on our firewall, we have proxy filters, and ipfilters. For some reason the proxy port filters don't work w/the the configured Concentrator port. We have to use Ip filters in order for the user to authenicate and get to their apps. Just a thought.

New Member

Re: CISCO VPN CLIENT(IPSec over UDP) <-> VPN Concentrator : PROB

You may have to add the servers being used to the client's host file so they will be able to find them.