Unable to Connect Multiple VPN Clients via Linksys Router

[mmcnichol]

We are an organization of 3 people who need to connect to our head office's VPN using Cisco VPN Client 4.0.5(Rel) client software over the Internet. We have installed the Linksys WRT54G (version 5, with Firmware Version: v1.01.0) wireless router with a Static IP address, and are using its DHCP server. We all have access to the Internet, however only one person can be logged into our VPN via the Cisco client at a time. If a 2nd or 3rd user attempts to log in, the other connected user is bumped out of the VPN and loses that connection. How can we overcome this issue?

We are using the VPN client with IPSec/UDP and have enabled Transparent Tunneling. All 3 of us do use the same Group Authentication name and password, but we each have different accounts when attempting to log into our VPN (each person has a unique Username and Password).

Any thoughts on how we can overcome this? I have tried switching to TCP, but that would now allow us to connect - so I think we need to use UDP. Would Port Forwarding work? If so, how would I set that up for both the laptops we use, the VPN clients, and the router?

Any help is much appreciated.

Thanks in advance,

Morgan

[#2]

Make sure you have the latest Firmware veriosn on the Linksys router.Configured router for natting with no traffic being blocked from the internal network of the router.Refer the following URL for more information in configuring VPN client

http://www.cisco.com/univercd/cc/td/doc/product/vpn/client/rel4_0/405cclnt.htm

[boschrexroth]

Did you get this to work as I am having the same issue.

Thanks.

[scottosan]

Keep in mind there are several flavors of IPSec. Standard, IPSec ofver UDP, and IPSec of TCP. You will see these option in the Cisco VPN client. Many lower end devices do not support IPSec over TCP, only standard IPSec. Standard IPSec and IPSec over UDP will not work properly if all three employees are being NAT/PAT'd to a single public IP address. They require a 1 for 1 translation. IPSec over TCP on the other hand does not require a 1 for 1 and has no issues with multiple users being NAT'ed to the same public IP. So if this is the case, your best bet would be to get a cheap VPN router that established a single IPsec tunnel at the hardware level and routes all of the users over that single IPSec tunnel using just a single public IP.

Hope this helps

[janf]

The PIX or ASA at the head office needs NAT Traversal enabled on it.

http://www.cisco.com/en/US/docs/security/pix/pix63/configuration/guide/ipsecint.html#wp1057446