Re: Cisco VPN Client Behind Firewall

On Mon, 19 Dec 2005 13:37:34 -0600
"Richard St John" <Richard.StJohn@gbe.com> wrote:

> We recently rolled out a remote access tool that requires the Cisco
> VPN Client.
>
> It is working all over the world with no issues.....except for some
> personnel we have on vendor/customer sites which are behind another
> companies corporate firewall.

Ask your cisco admin how your client/access system is configured for NAT
traversal as company firewalls usually don't know/allow transparent
IPSec-forwarding (and rightfully so).

Then (try to) have the two ports for IKE and NAT-T (UDP-encapsulation)
allowed outbound. Or (for routers) IKE and AH/ESP IP-types. These
changes are the same for all firewall brands. 

But as there is inherent danger in DAU-performed (even if probably only
loose) network coupling VPN traffic usually is not allowed through
properly managed firewalls. 

If you ever might have gotten a management permission for uncontrolled
network coupling done by users the FW admin should know how to enable
the requirements your cisco admin told you. There are waaay too many
variables to squeeze that problem into a DAU-safe cooking reciepe.

Bye

Volker


-- 

Volker Tanger    http://www.wyae.de/volker.tanger/
--------------------------------------------------
vtlists@wyae.de                    PGP Fingerprint
378A 7DA7 4F20 C2F3 5BCC  8340 7424 6122 BB83 B8CB