Solved

Allow CheckPoint SecureClient connection though PIX 501

Posted on 2004-10-03
3
320 Views
Last Modified: 2013-11-16
What are the exact configuration changes necessary to allow a Check Point SecureClient to connect to a VPN while behind a PIX 501? Or before the question can be answered what info do I need.
SecureClient gives me 2 NAT traversal mechanisms
1) Support IKE over TCP
2) Force UDP Encapsulation

Pix Version 6.3(1)
PDM Version 3.0(1)
Inside Interface 139.126.X.X
Outside Interface PPPoE (66.220.x.x)
0
Comment
Question by:awgooch
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 79

Expert Comment

by:lrmoore
ID: 12212282
1) upgrade PIX to 6.3(3) to enable nat-traversal
2) use the command "isakmp nat-traversal 20"
3) set client to force UDP encap (requires configuration on the Check Point end to allow this)

Alternative to upgrading:
1) Create a static 1-1 nat map using a spare public IP
2) set client for either TCP or UDP (depending on how the Check Point end is set up)
0
 

Author Comment

by:awgooch
ID: 12212482
Can you tell me more about the static 1-1 nat map using a spare puplic IP?
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 125 total points
ID: 12212571
If you have another public IP that you can use besides the interface, you can do this:

static (inside,outside) <public IP> <private ip> netmask 255.255.255.255

ie.

static (inside,outside) 24.56.78.9 192.168.100.100 netmask 255.255.255.255
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Overview The Cisco PIX 501, PIX 506e, ASA 5505 and ASA 5510 (most if not all of this information will be relevant to the PIX 515e but I do not have a working configuration handy to verify the validity) are primarily used within small to medium busi…
Do you have a windows based Checkpoint SmartCenter for centralized Checkpoint management?  Have you ever backed up the firewall policy residing on the SmartCenter?  If you have then you know the hassles of connecting to the server, doing an upgrade_…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

733 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question