SV: Cisco VPN Client Behind Firewall

Well, that really depends on a few things, I don't know
sidewinder,symantec,netscreen vpn specifics.....but, I know this :

If a manufaturer follows the IPSec "standard" it will require Port 500 UDP
(ike) outgoing, Protocol 50/51 (esp/ah) and many firewalls will have
problems with this if you are using port translation (many-to-one NAT), that
is pretty much always an issue with legacy ipsec implementations, nowadays
ppl use udp and tcp encapsulation of the encrypted data on some specific
ports, Cisco vpn3000 uses udp 500 and 10000 per default, but can be
configured for many other ports. Checkpoint uses a bunch of ports for
different things, as listed here :
http://www.fw-1.de/aerasec/ng/ports-ng.html

Also newer standards like NAT Traversal attempt to implement encapsulation
standards (RFCs 3947 and 3948), NAT-T uses udp 4500.

Many times it is my experience that VPN's cause problems mainly when devices
are behind nat and doing legacy ipsec tunneling, other than that I have
pretty much only had problems with interoperability between vendors and
stupid typos in configs.

Regards,
Jan
> We recently rolled out a remote access tool that requires the Cisco VPN
Client.
> It is working all over the world with no issues.....except for some
personnel we have on vendor/customer sites which are behind another
companies