NETWORK PRESENCE ABOUT SERVICES PRODUCTS TRAINING CONTACT US SEARCH SUPPORT
 


Search
display results
words begin  exact words  any words part 

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: [FW1] IPSEC encapsulated in UDP don't work with NAT.



You should check the objects.C file on the management station and verify the
following two options are set to TRUE.  In the :props section near the
bottom you will see

userc_NAT (true)
userc_IKE_NAT (true)

Be sure to stop the firewall, open the file, save file, start firewall, push
policy.

-Warren.

-----Original Message-----
From: Byoung Sun Yu [mailto:[email protected]]
Sent: Friday, January 12, 2001 10:51 AM
To: 'LOLLIKE,THOMAS (HP-Denmark,ex1)';
[email protected]
Subject: RE: [FW1] IPSEC encapsulated in UDP don't work with NAT. 



Do you have dump on server side as well? Do you see UDP 2746 coming in to
the right interface of FW? Is there any reply from FW? You might want to see
this on FW side to find out what happens.

HTH,

Sun Yu, CISSP
Lucent Worldwide Services


> -----Original Message-----
> From: [email protected]
> [mailto:[email protected]]On Behalf Of
> LOLLIKE,THOMAS (HP-Denmark,ex1)
> Sent: Friday, January 12, 2001 8:49 AM
> To: '[email protected]'
> Subject: [FW1] IPSEC encapsulated in UDP don't work with NAT.
>
>
>
> Hello
>
> I can't get SecuRemote working true NAT(hide) devices. I am
> running FW-1
> ver. 4.1 SP2, and SecuRemote build 4165.
> I works fine without NAT, when dialing direct to a ISP. I am
> sure that it
> get's UDP encapsulated, se output from windump.
>
> It is tested with Cisco router, PIX and Shiva router as NAT devices.
>
> Does anyone have an idear. !!!!
>
> Best Regards
>
> Thomas lollike
> mailto:[email protected]
>
>
> windump -n host cp-firewall
> windump: listening on\Device\Packet_NdisWan5
> 15:26:17.142381 client.tele.dk.500 > cp-firewall.500: isakmp:
> phase 1 I
> ident: [|sa]
> 15:26:17.352684 cp-firewall.500 > client.tele.dk.500: isakmp:
> phase 1 R
> ident: [|sa]
> 15:26:17.382732 client.tele.dk.500 > cp-firewall.500: isakmp:
> phase 1 I
> ident: [|ke]
> 15:26:17.633074 cp-firewall.500 > client.tele.dk.500: isakmp:
> phase 1 R
> ident: [|ke]
> 15:26:17.663118 client.tele.dk.500 > cp-firewall.500: isakmp:
> phase 1 I
> ident[E]: [|id]
> 15:26:18.033655 cp-firewall.500 > client.tele.dk.500: isakmp:
> phase 1 R
> ident[E]: [|id]
> 15:26:18.143807 cp-firewall.500 > client.tele.dk.500: isakmp:
> phase 1 R
> ident[E]: [|id]
> 15:26:18.203905 cp-firewall.500 > client.tele.dk.500: isakmp:
> phase 1 R
> ident[E]: [|id]
> 15:26:18.384153 cp-firewall.500 > client.tele.dk.500: isakmp:
> phase 2/others
> R #6[E]: [|hash]
> 15:26:18.404192 client.tele.dk.500 > cp-firewall.500: isakmp:
> phase 2/others
> I #6[E]: [|hash]
> 15:26:18.584453 cp-firewall.500 > client.tele.dk.500: isakmp:
> phase 2/others
> R #6[E]: [|hash]
> 15:26:18.604467 client.tele.dk.500 > cp-firewall.500: isakmp:
> phase 2/others
> I #6[E]: [|hash]
> 15:26:18.794744 cp-firewall.500 > client.tele.dk.500: isakmp:
> phase 2/others
> R #6[E]: [|hash]
> 15:26:18.794753 cp-firewall.500 > client.tele.dk.500: isakmp:
> phase 2/others
> R #6[E]: [|hash]
> 15:26:18.814778 client.tele.dk.500 > cp-firewall.500: isakmp:
> phase 2/others
> I #6[E]: [|hash]
> 15:26:18.914910 client.tele.dk.500 > cp-firewall.500: isakmp:
> phase 2/others
> I #6[E]: [|hash]
> 15:26:19.015056 client.tele.dk.500 > cp-firewall.500: isakmp:
> phase 2/others
> I #6[E]: [|hash]
> 15:26:19.315510 client.tele.dk.500 > cp-firewall.500: isakmp:
> phase 2/others
> I oakley-quick[E]: [|hash]
> 15:26:19.645965 cp-firewall.500 > client.tele.dk.500: isakmp:
> phase 2/others
> R oakley-quick[E]: [|hash]
> 15:26:19.666009 client.tele.dk.500 > cp-firewall.500: isakmp:
> phase 2/others
> I oakley-quick[E]: [|hash]
> 15:26:19.766142 client.tele.dk.500 > cp-firewall.500: isakmp:
> phase 2/others
> I oakley-quick[E]: [|hash]
> 15:26:19.866286 client.tele.dk.500 > cp-firewall.500: isakmp:
> phase 2/others
> I oakley-quick[E]: [|hash]
> 15:26:19.966435 client.tele.dk.2746 > cp-firewall.2746:  udp 116
> 15:26:20.967869 client.tele.dk.2746 > cp-firewall.2746:  udp 116
> No answer from Firewall !!
>
>
>
> ==============================================================
> ==================
>      To unsubscribe from this mailing list, please see the
> instructions at
>                http://www.checkpoint.com/services/mailing.html
> ==============================================================
> ==================
>



============================================================================
====
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
============================================================================
====


================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================



 
----------------------------------

ABOUT SERVICES PRODUCTS TRAINING CONTACT US SEARCH SUPPORT SITE MAP LEGAL
   All contents © 2004 Network Presence, LLC. All rights reserved.