IPSEC Client trough the pix firewall

[sfanayei]

Hi,

How can I allow my users behind a pix firewall with NAT/PAT to start a vpn connection to outside? Any help will be appreciated

[jackko]

it also depends on the kind of vpn, ipsec or pptp?

assuming internet connectiviy is active for the inside host, and no outbound restriction.

for ipsec, an inbound acl maybe required in permitting the followings:

udp 500

udp 4500

esp

for pptp, all required is the fixup protocol command:

fixup protocol pptp 1723

[brad]

Hi

The technique that you use is largely dependant on the specific VPN client and the device they are connecting too. If the client is the Cisco VPN client and the device supports NAT Transversal or IPSec/UDP, you shouldn't really have to do anything.

However, many VPN solutions do not support these features. In these cases you may have to create a static nat between the PC and an available outside IP.