IPSec VPN connection from behind a PAT firewall?

JammyPak
JammyPak used Ask the Experts™
on
Hi folks,

I know that I cannot create a outbound PPTP-based VPN connection from behind my PAT firewall (Cisco PIX) without creating static mappings between the internal (private) and an external (public) address. Obviously this isn't feasible, since I would need to have a separate public address for everyone who needs/wants to make an outbound VPN connection, and I'd need to setup static mappings for each address.

However; can anyone confirm or deny whether this is possible when using IPSec to create the firewall connection?

Basically, I would like to have a way to allow people from behind my firewall to make a VPN connection to another office, ideally without 1-1 address mapping. I don't want to have a LAN-LAN VPN tunnel, I want it PC-LAN.

Thanks!
JP
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®

Commented:
I don't see how. IPSec needs UDP 500 and IP proto 50/51. In a sense, it's "IP-in-IP", so AFAIK, it can't work through a PAT.
Commented:
Yes I use IPSec through NAT all the time.

The trick is to enable the "IPSEC over TCP" setting in the client that you are using, and make sure that it is enabled on the other side as well.
You can also use UDP instead of TCP.

Basically, the protocol 50 (and 51 if you are using AH) will get encapsulated in a TCP packet and look like normal TCP/IP traffic to the NAT device.

I have many contractors that use this type of connectivity today.

Commented:
BTW the default TCP port for IPSec over TCP is port 10000.
Should you be charging more for IT Services?

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Commented:
Basically, the protocol 50 (and 51 if you are using AH) will get encapsulated in a TCP packet and look like normal TCP/IP traffic to the NAT device.

NAT should read PAT

Author

Commented:
Hi folks, thanks for the responses.

t1n0m3n, I'll try this out and let you know how it goes!

Author

Commented:
Seems to work great - thanks!

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial