Contivity Client from Behind PIX 501

Nov 25, 2005 1 Replies

Rate this thread:

Hello,

Here is my desired configuration:

Customer 1 = PPTP (my office) -> PIX -> Internet -> PIX (This works!) Customer 2 = Contivity VPN Client (my office) -> PIX -> Internet ->

Contivity 600 (Does not work)

I own the PIX, a customer owns the Contivity.

I have the PIX working, I needed to be able to connect to a customer's PIX VPN via PPTP which is working fine (customer 1). But customer 2 has a Contivity 600, I can connect to them via my 'linksys' box so I know it works, when I replace the linksys with the PIX the connection does not work, the Contivity Client responds with "Login Failure do to: Remote host not responding" and the PIX log gets the message "302015: Built outbound UDP connection 56 for outside:/500 to inside

What version Contivity? 3.x did not support NAT-T VPN.

Also, what version PIX? The issue here is probably NAT. I assume you are doing NAT overload to a single IP address?

It matters what flavor Contivity VPN you are using. If you are doing old-style ESP/USP NAT (IP protocol 50 and UDP 500) the PIX will not translate that. You need to run the Contivitiy in a NAT-T mode. (UDP 500 + UDP 4500)

The Linksys supports this IPSEC passthru mode and though you can also configure the PIX to do so in 6.3 and later (" fixup protocol esp-ike ") but I generally will not recommend that since it works for exactly one connection and potentially screws up other IKE users. Long story.

If you can get NAT-T on the Contivity, that is the best bet.

Contivity Client from Behind PIX 501

Join the Discussion

Didn't find your answer?