Printable View
Hi folks,
Does anyone know how to pass incoming VPN traffic (L2TP over IPSec) through a PIX (or any other) firewall to an MS ISA server on the inside? I can do PPTP, but I can't seem to put L2TP work. The client is a Win2K computer (DUN).
b.t.w. The Pix is NATting the traffic so the ISA server has a private IP address.
Any help is greatly appreciated.
Think you are going to have to setup a 1 to 1 NAT for your server so that it can be reached from the outside.
You are also going to have to put an incoming access-list on your outside interface to permit the protocol (protocol 50/udp 500 for IPSec, not sure about L2TP) (and anything else you want to come in), followed by a deny ip any any.
Hope that helps,
/nebulus
Found this via link beneath :Quote:
In other words, you want the traffic bound for true Internet destinations to be NATed, and you want the traffic destined to travel through the IPSec tunnel to be tunneled, not NATed. On Cisco equipment, this is accomplished using an access control list.
http://www.zdnet.com.au/newstech/sec...0262010,00.htm
Seems NAT breaks the VPN using L2TP.
This is an interesting topic indeed, had some issues to in the past on this topic. Finally we went back to PPTP and that worked :s, and still does.
The only thing i never tried is setting the box as a DMZ, but this is just a wild guess.
Greetz,
Like I said, never done L2TP, but we do do NAT while passing IPSEC with no issues, but you do have to 1 to 1 NAT the box.Quote:
Originally posted here by .: Shrekkie :.
Found this via link beneath :
http://www.zdnet.com.au/newstech/sec...0262010,00.htm
Seems NAT breaks the VPN using L2TP.
This is an interesting topic indeed, had some issues to in the past on this topic. Finally we went back to PPTP and that worked :s, and still does.
The only thing i never tried is setting the box as a DMZ, but this is just a wild guess.
Greetz,
/nebulus
I think this may help you..
http://www.cisco.com/en/US/tech/tk58...800942ad.shtml
gunit0072003 , I get a 404, you might wanna adjust the url ;)
I am indeed able to use PPTP, but then, I don't get any encryption.
That part is very important for me.
I'm still researching this problem.
Thanks anyway for the suggestions. :)
Try looking into UDP encapsulation of IPsec traffic. Has ups and downs but may be worth investigating.
-Maestr0
http://www.vpnc.org/ietf-ipsec/01.ipsec/msg02243.html
http://www.ietf.org/internet-drafts/...-encaps-06.txt
http://www.ittc.ku.edu/~kpm/EECS801-Fall2001/
Las I checked Cisco had a readme about how it's (or M$) implementation of this particular feature is broken or are incompatible. Sometimes there are no easy answers.
KorpDeath is almost right. lt2p will work only for Win 2k lt2p and pix software version 6.0 or higher. There is an example on cisco's site, but you have to have a CCO account. Here it is.
http://www.cisco.com/warp/customer/110/l2tp-ipsec.html