Cisco VPN Client behind NAT with multiple users

I need some advise. I have a customer that is using a Cisco VPN client into their PIX at the main location. At the remote side they have a Netgear WGT624 router with the latest firmware. When the first user authenticates it prompts for the password and works great. When the second user trys to connect he is not even prompted for a password and is immediately logged in. The second user is authenticated with the username and password of the first user. If the both users log off and the second user logs in, he is prompted for his password and all is well. Since it appears that I each VPN tunnel needs it own global address, my solution is to order multiple static IP's from my provider and setup dynamic NAT on a 26xx:

ip nat pool ADDRESSES 12.1.1.1 12.1.1.6 mask 255.255.255.248 access-list 1 permit 192.168.1.0 0.0.0.255 ip nat inside source list 1 pool ADDRESSES int f0/0 ip nat inside int s0/0 ip nat outside

I believe this solution will work but is there no other solution I can implement on my Netgear device? This is not exactly a cheap solution.

Greg

In article , wrote: :I need some advise. I have a customer that is using a Cisco VPN client :into their PIX at the main location. At the remote side they have a :Netgear WGT624 router with the latest firmware. When the first user :authenticates it prompts for the password and works great. When the :second user trys to connect he is not even prompted for a password and :is immediately logged in. The second user is authenticated with the :username and password of the first user. If the both users log off and :the second user logs in, he is prompted for his password and all is :well. Since it appears that I each VPN tunnel needs it own global :address, my solution is to order multiple static IP's from my provider :and setup dynamic NAT on a 26xx:

You need "nat traversal". You could try turning it on on the PIX, isakmp nat-traversal 20 and see if that helps; if not, then it might be time to think about replacing the Netgear with something that does support NAT-T.