Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Permit Cisco VPN Software to pass through ISA Server

Posted on 2007-12-06
9
Medium Priority
?
1,191 Views
Last Modified: 2010-08-05
I have an ISA Server 2004 firewall that has been working great for about 4 years. The state has now required that we connect to their systems using the Cisco VPN Software. I have set it up but it doesn't work and I am sure it is because the ISA firewall will not permit it.

I need to know exactly what to do to allow 5 specific workstations to use the VPN software to connect to the State's system.

Thanks - DL
0
Comment
Question by:DLockwood
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
  • 3
9 Comments
 
LVL 19

Accepted Solution

by:
SteveH_UK earned 2000 total points
ID: 20419393
You need to check in the Cisco client which port it is using (it is configurable) and allow it to the VPN gateway.

Also, ensure that AH and ESP IP protocols are allowed (IP 50,51), IKE (UDP 500) and NAT-T (UDP 4500).

We did this with ISA 2006.  In our case the Cisco client was expecting to use port 10000.
0
 

Author Comment

by:DLockwood
ID: 20419459
OK - But what actual steps do I take?

It is using port 10,000, but I have NO idea where to even begin.

Thanks.
0
 
LVL 19

Assisted Solution

by:SteveH_UK
SteveH_UK earned 2000 total points
ID: 20419493
In ISA Management, you need to configure a new access rule.

Use the following settings:

Type:   Allow
From:   Internal Network (or a subset)
To:       IP address of VPN gateway (the remote site, e.g. vpn.company.com)
Protocols: AH, ESP, IKE, NAT-T

On the protocols page, if they don't already exist you will need to create them.

See http://www.isaserver.org/articles/IPSec_Passthrough.html for some more help with this.
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 20421956
The link is for ISA2000 so the process is a little different - that said, the ports required are described in the link comprehensively. The ports you need will depend on the transport options you have selected in the VPN client.

For isa 2004/2006,
Open the ISA gui - right-=click the firewall policy then select new - access rule and follow the wizard.
When asked for the protocols, choose selected and then select from the list. if the protocol you want is not there (they ARE there though), youcan select new and create your own.

In the from box select internal and in the TO box select external - then all users.

Keith
0
 

Author Comment

by:DLockwood
ID: 20423454
Keith, does the access rule need to permit inbound and outbound?
0
 
LVL 19

Expert Comment

by:SteveH_UK
ID: 20424118
Permit outbound is required
0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 20427816
Steve is correct - outbound only needs setting up - once the connection is established (and ISA will allow this as the setup in initiated outbound and the responses will be permitted as they are response packets) then there will be a tunnel from the client to the destination and ISA will just forward the packets to and fro like a forwarder.
0
 

Author Closing Comment

by:DLockwood
ID: 31413129
Hi Guys - It workled brilliantly. I hope you do not mind me splitting the points, but to be perfectly honest with you, I used both answers to get the job done.

Thanks again - DL!
0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 20445144
oh well...
0

Featured Post

How to Use the Help Bell

Need to boost the visibility of your question for solutions? Use the Experts Exchange Help Bell to confirm priority levels and contact subject-matter experts for question attention.  Check out this how-to article for more information.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There are three types of ISA client that can be configured - these can be individual clients or multiples of a client on each PC or server SecureNAT. A SecureNAT client for ISA server is a client machine, work station or server, that has its defa…
I have been asked to explain on many, many occasions the correct way to setup network cards and DNS settings on ISA Server 2004, 2006 and forefront Threat management gateway (FTMG) and have willing done so. I have also promised my self everytime tha…
Have you created a query with information for a calendar? ... and then, abra-cadabra, the calendar is done?! I am going to show you how to make that happen. Visualize your data!  ... really see it To use the code to create a calendar from a q…
We’ve all felt that sense of false security before—locking down external access to a database or component and feeling like we’ve done all we need to do to secure company data. But that feeling is fleeting. Attacks these days can happen in many w…

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question