Solved

Trying to pass IPSec packets inbound through a Symantec Gateway Security 360 device

Posted on 2008-10-24
3
419 Views
Last Modified: 2012-08-13
I'm stumped on a firewall configuration.

The current network I'm working on uses a Symantec Security Gateway 360 for Internet protection and access. They have a Microsoft VPN server (Windows Server 2K3 Standard) located behind this device succesfully receiving and responding to PPTP requests for connections. I want to 'upgrade' this connection to start receiving IPSec traffic.

I've placed the VPN server on the Internet for short times to test the IPSec VPN connection. MS clients do connect to the server via IPSec when the server is directly on the Internet. However, management has stated all servers be covered behind the firewall device. (I know we can use the MS filters and such on the VPN application to keep the Internet at bay, but I have a few rules to follow here ;)

It seems like the SGS device is blocking protocols 50 (ESP) and 51 (AH) from passing packets inbound through this device to the MSVPN server. I see where I can open TCP and UDP ports, but not full protocols on the SGS device. (GRE is working via an expressed PPTP pasthru switch. No such switch for IPSec - that I have found so far.)

Anyone out there with experience on the SGS360? The user documentation and symantec help line have been weak at best.

Thanks!
0
Comment
Question by:tmzagar
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 13

Expert Comment

by:Quori
ID: 22806450
Do you have UDP 500 open? Also may need 4500/tcp and 4500/udp (IPSec NAT traversal).
0
 

Author Comment

by:tmzagar
ID: 22811802
More info and andswer to above:
The following 'VPN' ports are open:
(Remember that I'm trying to use a MS client over L2TP. Currently use PPTP.)
TCP/1723
TCP/1701
UDP/500
UDP/4500

As stated I have connected to this server via L2TP/IPSec when outside firewall. I wiresharked that connection. I also wiresharked the connection that didn't work. It kinna looks like all negotiations are working until the connection tries to "handoff" to protocol ESP. (just my humble opinion.)
0
 

Accepted Solution

by:
tmzagar earned 0 total points
ID: 23085639
Since the SGS seems to be going to an end of life and we are in need of the IPSec connection for its inherent security, I convinced the management to 'expose' one nic on the RRAS server to the DMZ. We applied filters to this interface to keep out all the undesired packets and poof! we now have an IPSec VPN connection endpoint. Clients are now enjoying VPN over IPSec.
0

Featured Post

What Is Transaction Monitoring and who needs it?

Synthetic Transaction Monitoring that you need for the day to day, which ensures your business website keeps running optimally, and that there is no downtime to impact your customer experience.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I recently had the displeasure of buying a new firewall at one of the buildings I play Sys Admin at. I had to get a better firewall than the cheap one that I had there since I was reconnecting the main office to the satellite office via point-to-poi…
We sought a budget ($5,000) firewall solution that would provide all the performance we needed with no single point of failure.  Hosting a SAAS web application in our datacenter, it was critical that we find a way to keep connectivity up and inbound…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…

695 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question