VPN Client 3.5 and NAT

[schorb]

I use an CISCO 800 to connect the ISP over ISDN performing address-negotiation and NAT. I can't find a way to use a VPN-Client 3.5 at my inside notebook to connect to a PIX (6.1.1) at the outside:

VPN-Client --- 800 --- ISDN --- ISP --- 3620 --- PIX

I use the same way with a Netgear-DSL-Router performing NAT and that works !

Any ideas ?

Frank

[s.vidanovic]

I have a similiar issue. My configuration is the following:

VPN Client -- PIX -- Router -- ISP -- Router -- PIX

I'm siting behind left PIX with VPN Client. If I configure left PIX to do address hiding with range of addresses (NAT) I CAN established the tunnel. But if I configure left PIX to do address hiding with one address (PAT) I CAN NOT establish the tunnel. In that case I receive in syslog form left PIX "Deny inbound (no xlate) protocol udp/500 on interface outside".

You should check syslog messages from your 800 Router doing NAT.

In "IPSec VPNs in depth" document, there is a good explanation of using NAT after IPSec, and there Cisco says that some devices do not handle properly VPNs if PAT is used (are we speaking here of Cisco routers and PIX firewall?).

Another possibility is to try IPSec over TCP, but I did not manage to do it. What should I configure on right PIX in order to achiueve this.

Cisco guys, where are you? We need you ...

Sasa Vidanovic