[FW-1] Problem with Secure client behind NAT

[Christian Koefoed <cko@FW1-NOSPAMTK.DK>]

Hi,

Problem: My Secure Clients are not able to connect to the policy server
when they connect from behind a NAT router. If the secure client has a
public address there is no problem.

I suspect UDP Encapsulation to be the problem: If I have a working client
with a public IP, but if I mark 'Force UDP Encapsulation' this client also
fails to get a policy from the policy server.
I've tried to connect this client directly to the outside of the firewall,
and it only works if UDP encapsulation is off.

Any suggestions?

Software on firewall is CP NG FP2, Hardware: Nokia IP330, client is newest
version. I've tried Transparent mode, Connect mode with and without office
mode - same result. I've also tried 'Support IKE over TCP'.
There is no filter on  the NAT Router.

Please help,

Christian Koefoed

=================================================
To set vacation, Out Of Office, or away messages,
send an email to LISTSERV@lists.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================