Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

VPN-Client to PIX through PAT...

Hi,

I've this configuration:

vpn connection from Cisco client 3.5 to PIX515 ver. 6.2(1) whit preshared key.

The client initiate the connection behind another PIX that make pat translation...

I' ve a problem about the IKE negotiation... (this problem doesn't exist when the connection is to a concentrator!)

Instead, If I statically nat the pc with the client installed, all work well ! ! !

is there a workaround?

I mean...

1)- 6.2 (1) PIXos version, resolve this caveats?

2)- can I configure the client whit manual ipsec, without the IKE negotiation?

are there other suggestions?

thanks in advance!

Graz.

2 REPLIES
New Member

Re: VPN-Client to PIX through PAT...

I opened a TAC case on a similar problem recently. The upshot of the case is that the PIX doesn't support VPNs when the client is behind a device doing PAT.

Here's what the TAC tech had to say about it:

*** CASE LOG 31-MAY-2002 07:27:45 PST ***

Called Kevin. The user that has the problem can connect when he tested it just outside the firewall going through an isp, but when she goes home behind a cable modem she cannot connect. He suspects they are patting her out which the pix does not support. Kevin thanked me for the help and gave the ok to close this case.

AND THIS IS FROM AN EMAIL HE SENT TO ME::

"Unfortunately the options you are talking about are only for tunnels being terminated on a Concentrator. The Pix does not support these. An example of using these is if you had a vpn client behind a pix that was patting them out and the tunnel is terminating on a vpn Concentrator. You would then want to check 'Allow IPSec over UDP' or 'Use IPSec over TCP' depending on what you configure on the Concentrator."

- K

New Member

Re: VPN-Client to PIX through PAT...

Thaks!

regards,

Graz.

86
Views
0
Helpful
2
Replies