[FW1] IPSEC encapsulated in UDP don't work with NAT.

["LOLLIKE,THOMAS (HP-Denmark,ex1)" <thomas_lollike@FW1-NOSPAMhp.com>]

Hello 

I can't get SecuRemote working true NAT(hide) devices. I am running FW-1
ver. 4.1 SP2, and SecuRemote build 4165. 
I works fine without NAT, when dialing direct to a ISP. I am sure that it
get's UDP encapsulated, se output from windump.

It is tested with Cisco router, PIX and Shiva router as NAT devices.

Does anyone have an idear. !!!! 

Best Regards

Thomas lollike
mailto:thomas_lollike@hp.com


windump -n host cp-firewall
windump: listening on\Device\Packet_NdisWan5
15:26:17.142381 client.tele.dk.500 > cp-firewall.500: isakmp: phase 1 I
ident: [|sa]
15:26:17.352684 cp-firewall.500 > client.tele.dk.500: isakmp: phase 1 R
ident: [|sa]
15:26:17.382732 client.tele.dk.500 > cp-firewall.500: isakmp: phase 1 I
ident: [|ke]
15:26:17.633074 cp-firewall.500 > client.tele.dk.500: isakmp: phase 1 R
ident: [|ke]
15:26:17.663118 client.tele.dk.500 > cp-firewall.500: isakmp: phase 1 I
ident[E]: [|id]
15:26:18.033655 cp-firewall.500 > client.tele.dk.500: isakmp: phase 1 R
ident[E]: [|id]
15:26:18.143807 cp-firewall.500 > client.tele.dk.500: isakmp: phase 1 R
ident[E]: [|id]
15:26:18.203905 cp-firewall.500 > client.tele.dk.500: isakmp: phase 1 R
ident[E]: [|id]
15:26:18.384153 cp-firewall.500 > client.tele.dk.500: isakmp: phase 2/others
R #6[E]: [|hash]
15:26:18.404192 client.tele.dk.500 > cp-firewall.500: isakmp: phase 2/others
I #6[E]: [|hash]
15:26:18.584453 cp-firewall.500 > client.tele.dk.500: isakmp: phase 2/others
R #6[E]: [|hash]
15:26:18.604467 client.tele.dk.500 > cp-firewall.500: isakmp: phase 2/others
I #6[E]: [|hash]
15:26:18.794744 cp-firewall.500 > client.tele.dk.500: isakmp: phase 2/others
R #6[E]: [|hash]
15:26:18.794753 cp-firewall.500 > client.tele.dk.500: isakmp: phase 2/others
R #6[E]: [|hash]
15:26:18.814778 client.tele.dk.500 > cp-firewall.500: isakmp: phase 2/others
I #6[E]: [|hash]
15:26:18.914910 client.tele.dk.500 > cp-firewall.500: isakmp: phase 2/others
I #6[E]: [|hash]
15:26:19.015056 client.tele.dk.500 > cp-firewall.500: isakmp: phase 2/others
I #6[E]: [|hash]
15:26:19.315510 client.tele.dk.500 > cp-firewall.500: isakmp: phase 2/others
I oakley-quick[E]: [|hash]
15:26:19.645965 cp-firewall.500 > client.tele.dk.500: isakmp: phase 2/others
R oakley-quick[E]: [|hash]
15:26:19.666009 client.tele.dk.500 > cp-firewall.500: isakmp: phase 2/others
I oakley-quick[E]: [|hash]
15:26:19.766142 client.tele.dk.500 > cp-firewall.500: isakmp: phase 2/others
I oakley-quick[E]: [|hash]
15:26:19.866286 client.tele.dk.500 > cp-firewall.500: isakmp: phase 2/others
I oakley-quick[E]: [|hash]
15:26:19.966435 client.tele.dk.2746 > cp-firewall.2746:  udp 116
15:26:20.967869 client.tele.dk.2746 > cp-firewall.2746:  udp 116
No answer from Firewall !!



================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================