Cisco Support Community
Community Member

VPN Client 3.0 trough NAT

Hi, already configure my pix for vpn and it’s working but only when I connect trough a ISP that assign IP public addressing (Im using VPN Client 3.0 for clients and terminating the VPN in a PIX ) if I use a ISP that assign private addressing the VPN its not established unless I assign a Static Translation to the Client (in the case of ISP support Static translations) this its not possible in most of cases for remote users that are traveling, My question is if its possible to establish a IPSec Tunnel over IP private addressing without using “statics” to establish the VPN or if its possible to use other method available supported by Cisco VPN Client 3.0 that works with NAT or PAT, the idea of use VPN Client it because it the only application that run on MAC OS X and my customer require this support.

Cisco Employee

Re: VPN Client 3.0 trough NAT

Unfortunately the current PIX code doesn't support the IPSec thru NAT functionality. It is already available on the client and currently supported on the

VPN 3000 concentrators but not as yet on the PIX code.

Community Member

Re: VPN Client 3.0 trough NAT

And what about udp encapsulation support on 6.2(1) release ?



Community Member

Re: VPN Client 3.0 trough NAT


what is the actual command syntax for UDP encapsulation in PIX 6.2(1). I am desparately looking for a solution to VPN tunnel through NAT/PAT to PIX.



Community Member

Re: VPN Client 3.0 trough NAT

Hi Roberto

I try my inside network with PIX PAT to connect with Cisco Concentrator 3005 in same location, I can make vpn connection, phase II is fine, but I cannot make any network connection, like no NAT or PAT. What do you think my problem?




Community Member

Re: VPN Client 3.0 trough NAT

You have to use a nat 0 command for all data destined for the remote VPN tunnel otherwise your packets will get natted and not work.

I assume you are trying to vpn between your pix and your concentrator.

Check Cisco Security tips for examples of this.

If it is a client related problem,

ensure that the concentrator has UDP 10000 checked and your client properties is also checked for transparent NAT.

I also found that in some cases, TCP encapsulation available with later versions of the client didn't work as well as UDP encapsulation through PAT devices.

Finally ensure you are running the latest versions of the VPN software which is 3.5.3 for the concentrators and 3.5.2 for the client.

Hope this helps

Inti Shah

Boxing Orange

Community Member

Re: VPN Client 3.0 trough NAT

Hi guys,

hope i'm not too late for this topic, I'm having the same issue here.

VPN client 3.5.1 outside and tunnel to PIX 506, right now the client is using a global address, but if i put it inside our network behind a firewall with NAT and with an static private address, i can't create the tunnel at all. beside static mapping on the firewall, what other options do i have. are there any configuration that i could get around this issue?

any suggestion would be appreciate.

CreatePlease to create content