My office has a 2811 acting as a Ipsec VPN gateway for roaming users.
My home has a Linksys router with NAT. I can not make more than one concurrent VPN connection ( via VPN Client 4.6 ) to my office. Only one PC at a time can make the connection.
Any advice is greatly appreciated.
Thanks,
DT
With IPsec you cannot have more than one IKE SA between a pair of two IP addresses. The translated WAN IP of your router is one IP, the WAN IP of your office VPN gateway the other.
A router with multi-user VPN passthrough should be able to handle different IPsec/L2TP/PPTP connections to different destinations. Don't know if the Linksys can do multiuser VPN passthrough.
You have to check NAT-Traversal in VPN Client's configuration.
I think the problem is some settings in my office router ( I set it :-) )
customer that uses VPN 3000 concentrator. This shows that the home router is fine for this scenario.
On the VPN client on my two PCs at home, I do have a check on the NAT-Traversal.
When I turn on the debug for crypto isakmp, I see the router reply with UPD packets port 4500 but then the 2nd connection never completes.
DT
Ahhh, I found it. It is one of the the ACLs was set wrong. When I first tried ipsec on the router, there was the following line in my ACL.
permit udp any eq non500-isakmp any eq non500-isakmp
This works for the first IPSEC from the same pair of IPs because it uses the source port 4500. For the next one, it changes the source port, of course, to differentiate the initiator, and this rule blocks it.
After changing that line to "permit udp any any eq non500-isakmp" my
2nd ipsec vpn connection works fine.DT
Have something to add? Share your thoughts — no account required.
Ask the community — no account required