[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] RE: [FW1] IPSEC encapsulated in UDP don't work with NAT.
You should check the objects.C file on the management station and verify the following two options are set to TRUE. In the :props section near the bottom you will see userc_NAT (true) userc_IKE_NAT (true) Be sure to stop the firewall, open the file, save file, start firewall, push policy. -Warren. -----Original Message----- From: Byoung Sun Yu [mailto:[email protected]] Sent: Friday, January 12, 2001 10:51 AM To: 'LOLLIKE,THOMAS (HP-Denmark,ex1)'; [email protected] Subject: RE: [FW1] IPSEC encapsulated in UDP don't work with NAT. Do you have dump on server side as well? Do you see UDP 2746 coming in to the right interface of FW? Is there any reply from FW? You might want to see this on FW side to find out what happens. HTH, Sun Yu, CISSP Lucent Worldwide Services > -----Original Message----- > From: [email protected] > [mailto:[email protected]]On Behalf Of > LOLLIKE,THOMAS (HP-Denmark,ex1) > Sent: Friday, January 12, 2001 8:49 AM > To: '[email protected]' > Subject: [FW1] IPSEC encapsulated in UDP don't work with NAT. > > > > Hello > > I can't get SecuRemote working true NAT(hide) devices. I am > running FW-1 > ver. 4.1 SP2, and SecuRemote build 4165. > I works fine without NAT, when dialing direct to a ISP. I am > sure that it > get's UDP encapsulated, se output from windump. > > It is tested with Cisco router, PIX and Shiva router as NAT devices. > > Does anyone have an idear. !!!! > > Best Regards > > Thomas lollike > mailto:[email protected] > > > windump -n host cp-firewall > windump: listening on\Device\Packet_NdisWan5 > 15:26:17.142381 client.tele.dk.500 > cp-firewall.500: isakmp: > phase 1 I > ident: [|sa] > 15:26:17.352684 cp-firewall.500 > client.tele.dk.500: isakmp: > phase 1 R > ident: [|sa] > 15:26:17.382732 client.tele.dk.500 > cp-firewall.500: isakmp: > phase 1 I > ident: [|ke] > 15:26:17.633074 cp-firewall.500 > client.tele.dk.500: isakmp: > phase 1 R > ident: [|ke] > 15:26:17.663118 client.tele.dk.500 > cp-firewall.500: isakmp: > phase 1 I > ident[E]: [|id] > 15:26:18.033655 cp-firewall.500 > client.tele.dk.500: isakmp: > phase 1 R > ident[E]: [|id] > 15:26:18.143807 cp-firewall.500 > client.tele.dk.500: isakmp: > phase 1 R > ident[E]: [|id] > 15:26:18.203905 cp-firewall.500 > client.tele.dk.500: isakmp: > phase 1 R > ident[E]: [|id] > 15:26:18.384153 cp-firewall.500 > client.tele.dk.500: isakmp: > phase 2/others > R #6[E]: [|hash] > 15:26:18.404192 client.tele.dk.500 > cp-firewall.500: isakmp: > phase 2/others > I #6[E]: [|hash] > 15:26:18.584453 cp-firewall.500 > client.tele.dk.500: isakmp: > phase 2/others > R #6[E]: [|hash] > 15:26:18.604467 client.tele.dk.500 > cp-firewall.500: isakmp: > phase 2/others > I #6[E]: [|hash] > 15:26:18.794744 cp-firewall.500 > client.tele.dk.500: isakmp: > phase 2/others > R #6[E]: [|hash] > 15:26:18.794753 cp-firewall.500 > client.tele.dk.500: isakmp: > phase 2/others > R #6[E]: [|hash] > 15:26:18.814778 client.tele.dk.500 > cp-firewall.500: isakmp: > phase 2/others > I #6[E]: [|hash] > 15:26:18.914910 client.tele.dk.500 > cp-firewall.500: isakmp: > phase 2/others > I #6[E]: [|hash] > 15:26:19.015056 client.tele.dk.500 > cp-firewall.500: isakmp: > phase 2/others > I #6[E]: [|hash] > 15:26:19.315510 client.tele.dk.500 > cp-firewall.500: isakmp: > phase 2/others > I oakley-quick[E]: [|hash] > 15:26:19.645965 cp-firewall.500 > client.tele.dk.500: isakmp: > phase 2/others > R oakley-quick[E]: [|hash] > 15:26:19.666009 client.tele.dk.500 > cp-firewall.500: isakmp: > phase 2/others > I oakley-quick[E]: [|hash] > 15:26:19.766142 client.tele.dk.500 > cp-firewall.500: isakmp: > phase 2/others > I oakley-quick[E]: [|hash] > 15:26:19.866286 client.tele.dk.500 > cp-firewall.500: isakmp: > phase 2/others > I oakley-quick[E]: [|hash] > 15:26:19.966435 client.tele.dk.2746 > cp-firewall.2746: udp 116 > 15:26:20.967869 client.tele.dk.2746 > cp-firewall.2746: udp 116 > No answer from Firewall !! > > > > ============================================================== > ================== > To unsubscribe from this mailing list, please see the > instructions at > http://www.checkpoint.com/services/mailing.html > ============================================================== > ================== > ============================================================================ ==== To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ============================================================================ ==== ================================================================================ To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================================================
|