VPN 3000 and Unidirectional traffic behind firewall
Here is a strange one .. I have a VPN3030 Concentrator (Version 4.1.4) to which I am able to connect without issue. The problem is that traffic is flowing in only 1 direction (according to the client - version 4.0.3C) it flows in the transmit to the concentrator, but not the receive. My client is sitting behind a PIX 501. I have opened everything up on the PIX and it still behaves the same way. Now, when I bypass the PIX and run the PPPoE client on my laptop, it connects and traffic flows in both directions. I am troubleshooting this for a customer who is not using PIX everywhere - they have several Watchguard firewalls deployed and they behave in the same manner. One point of note is that this problem does not happen to everyone .. only a handful of users with nothing in common except for the concentrator.
If anyone has seen this or has any insight/suggestions, it would be greatly appreciated.
Re: VPN 3000 and Unidirectional traffic behind firewall
Well, we looked at that initially and when we enabled NAT-T on the concentrator, I was not able to connect at all. My firewall has "fixup protocol ike-esp" configured as well as "isakmp nat-traversal 20". According to the concentrator, phase 2 completes and the tunnel is up ... just not passing traffic for some reason.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...