Firewall Wizards mailing list archives
Re: Cisco PIX VPN Pass-Through
From: Nick Chettle <lists () mogmail net>
Date: Mon, 13 Dec 2004 16:15:09 +0000
Hi Jason, Thanks for the advice.In order to enable NAT traversal I have to enable isakmp on the internal interface. When I do that, it tries to terminate the VPN on the PIX itself rather than passing the isakmp packets through to the internet. Is there anyway to tell it not to do that?
Thanks, Nick Hi Nick, It doesn't look like you have the "isakmp nat-traversal" command enabled. Hope this helps, from Cisco documentation: isakmp nat-traversal Network Address Translation (NAT), including Port Address Translation (PAT), is used in many networks where IPSec is also used, but there are a number of incompatibilities that prevent IPSec packets from successfully traversing NAT devices. NAT traversal enables ESP packets to pass through one or more NAT devices. The firewall supports NAT traversal as described by Version 2 and Version 3 of the IETF "UDP Encapsulation of IPsec Packets" draft, available at http://www.ietf.org/html.charters/ipsec-charter.html, and NAT traversal is supported for both dynamic and static crypto maps. NAT traversal is disabled by default on the firewall. To enable NAT traversal, check that ISAKMP is enabled (you can enable it with the isakmp enable if_name command) and then use the isakmp nat-traversal [natkeepalive] command. (This command appears in the configuration if both ISAKMP is enabled and NAT traversal is enabled.) If you have enabled NAT traversal, you can disable it with the no isakmp nat-traversal command. Valid values for natkeepalive are from 10 to 3600 seconds. The default is 20 seconds. Jason _______________________________________________ firewall-wizards mailing list firewall-wizards () honor icsalabs com http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
Current thread:
- Cisco PIX VPN Pass-Through Nick Chettle (Dec 13)
- <Possible follow-ups>
- Re: Cisco PIX VPN Pass-Through Nick Chettle (Dec 13)