Trying to pass IPSec packets inbound through a Symantec Gateway Security 360 device
I'm stumped on a firewall configuration.
The current network I'm working on uses a Symantec Security Gateway 360 for Internet protection and access. They have a Microsoft VPN server (Windows Server 2K3 Standard) located behind this device succesfully receiving and responding to PPTP requests for connections. I want to 'upgrade' this connection to start receiving IPSec traffic.
I've placed the VPN server on the Internet for short times to test the IPSec VPN connection. MS clients do connect to the server via IPSec when the server is directly on the Internet. However, management has stated all servers be covered behind the firewall device. (I know we can use the MS filters and such on the VPN application to keep the Internet at bay, but I have a few rules to follow here ;)
It seems like the SGS device is blocking protocols 50 (ESP) and 51 (AH) from passing packets inbound through this device to the MSVPN server. I see where I can open TCP and UDP ports, but not full protocols on the SGS device. (GRE is working via an expressed PPTP pasthru switch. No such switch for IPSec - that I have found so far.)
Anyone out there with experience on the SGS360? The user documentation and symantec help line have been weak at best.
Thanks!
The current network I'm working on uses a Symantec Security Gateway 360 for Internet protection and access. They have a Microsoft VPN server (Windows Server 2K3 Standard) located behind this device succesfully receiving and responding to PPTP requests for connections. I want to 'upgrade' this connection to start receiving IPSec traffic.
I've placed the VPN server on the Internet for short times to test the IPSec VPN connection. MS clients do connect to the server via IPSec when the server is directly on the Internet. However, management has stated all servers be covered behind the firewall device. (I know we can use the MS filters and such on the VPN application to keep the Internet at bay, but I have a few rules to follow here ;)
It seems like the SGS device is blocking protocols 50 (ESP) and 51 (AH) from passing packets inbound through this device to the MSVPN server. I see where I can open TCP and UDP ports, but not full protocols on the SGS device. (GRE is working via an expressed PPTP pasthru switch. No such switch for IPSec - that I have found so far.)
Anyone out there with experience on the SGS360? The user documentation and symantec help line have been weak at best.
Thanks!
Quori
Do you have UDP 500 open? Also may need 4500/tcp and 4500/udp (IPSec NAT traversal).
ASKER
More info and andswer to above:
The following 'VPN' ports are open:
(Remember that I'm trying to use a MS client over L2TP. Currently use PPTP.)
TCP/1723
TCP/1701
UDP/500
UDP/4500
As stated I have connected to this server via L2TP/IPSec when outside firewall. I wiresharked that connection. I also wiresharked the connection that didn't work. It kinna looks like all negotiations are working until the connection tries to "handoff" to protocol ESP. (just my humble opinion.)
The following 'VPN' ports are open:
(Remember that I'm trying to use a MS client over L2TP. Currently use PPTP.)
TCP/1723
TCP/1701
UDP/500
UDP/4500
As stated I have connected to this server via L2TP/IPSec when outside firewall. I wiresharked that connection. I also wiresharked the connection that didn't work. It kinna looks like all negotiations are working until the connection tries to "handoff" to protocol ESP. (just my humble opinion.)
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.