Re: Using Cisco VPN over a SBS 2003 network
- From: "Jim Harrison \(MSFT\)" <jmharr@xxxxxxxxxxxxxxxxxxxx>
- Date: Sun, 16 Jul 2006 09:18:23 -0700
You'll have to examine the VPN client & server configuration, but the defaults for both are to use "native" IPSec, which does not
tolerate NAT.
If possible, configure both to use NAT-T, which only requires outgoing traffic on UDP:500 and UDP:4500.
You should note that some Cisco VPN servers don't abide by RFC 3715 (ftp://ftp.rfc-editor.org/in-notes/rfc3715.txt), which allows
IPSec NAT-T to change the source port (normally UDP:500).
<quote>
2.1. Intrinsic NA(P)T Issues
....
d) Incompatibility between fixed IKE source ports and NAPT. Where
multiple hosts behind the NAPT initiate IKE SAs to the same
responder, a mechanism is needed to allow the NAPT to demultiplex
the incoming IKE packets from the responder. This is typically
accomplished by translating the IKE UDP source port on outbound
packets from the initiator. Thus responders must be able to
accept IKE traffic from a UDP source port other than 500, and must
reply to that port. Care must be taken to avoid unpredictable
behavior during re-keys. If the floated source port is not used
as the destination port for the re-key, the NAT may not be able to
send the re-key packets to the correct destination.
....
</quote>
--
--
Jim Harrison [ISA SE]
Read the help, books and articles!
This posting is provided "AS IS" with no warranties, and confers no rights.
"Phillip Avelar" <PhillipAvelar@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:FDFB1ED0-E593-4FB8-9F86-C54A49CA573D@xxxxxxxxxxxxxxxx
I looked for a possible solution but maybe someone has already dealt with
this. We remotely conenct to some of our clients to work on their systems
using their VPN client. We have not had any problems using the nortel client
but we have not been able to get a Cisco VPN client to connect over our
network. We know it has something to do with the NAT tranlation but have
tried opening ports without success.
Has anyone dealt and resovled this? We are not using ISA server.
.
- Prev by Date: Re: Managing Tunnel Ports - 8443
- Next by Date: Monitoring Connection Filtering
- Previous by thread: Re: Using Cisco VPN over a SBS 2003 network
- Next by thread: Re: Installing 2003 Small Business server with existing nt 4.0 Domain
- Index(es):
Relevant Pages
|
