Networks

Ask something
Discussion Locked

Cisco VPN Concentrator 3005 Problems

0 helpful
6 replies

by jfowler

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I am having problems getting the VPN 3005 up and running. We have an ISDN connection to the internet through our Ascend Pipeline 50 ISDN router. The Pipeline 50 router uses NAT and all machines on our LAN use private IP addresses. The only real address we have is assigned to the WAN interface on the pipeline 50. The LAN interface on the pipeline 50 has the address of 192.168.100.1, which we use as the default gateway. I have given the VPN 3005 private and public interfaces IP addresses 192.168.100.250 and 192.168.100.251 respectively. I have enabled IPSec through NAT in Configuration | User Management | Base Group and assigned it UDP port 10101. I have then configured static mappings of UDP ports 500 and 10101 to 192.168.100.251 (public interface on the 3005) in the NAT configuration on the Pipeline 50. I have the client installed on a notebook PC that dials into a Internet account. I setup the VPN dialer to connect to the WAN IP address of the Pipeline 50 ISDN router. It gets to Negotiating security profiles, pauses, and then it comes back with "Unable to negotiate IPSec or host did not respond". This is my first experience with VPN and I feel I'm in a little over my head. Any help is appreciated

6 replies

by Former member

The VPN Cisco router must have a valid, public IP address. You listed two private addresses. Then test without using IPSec first, then add IPSec last, after VPN works correctly.

by jfowler

Well, your answer helped somewhat. Yes you were correct in the fact that the public and private interfaces need to be on separate networks and this ended up being my main problem. However, the public interface does NOT have to have a valid, public IP address. I kept the private IP address 192.168.100.250 on the private interface and changed the public interface to 192.168.200.250. I then added a second IP address of 192.168.200.1 to the Pipeline's LAN interface and configured that as the default gateway on the VPN 3005. I then changed the NAT static mappings of UDP ports 500 and 10101 (The port I assigned to "IPSec through NAT" on the 3005) to the public interface on 192.168.200.250. I also ended up upgrading the software on the pipeline to 6.1.44 from 6.1.7 which may have helped as well. I did try upgrading to the latest version, 8.0-101.0, but the routing table got all jacked and I ended reverting back to 6.1.44. I am still waiting for Lucent (who now owns Ascend) to reply with a fix to my routing problems with the latest version.

by edkeogh

I am not familiar with the specific NAT features on the Pipeline 50, but some NAT implementations do not support the ports used by IPSec to establish communications from Client to Server.
One workaround is to setup a STATIC NAT mapping between the outside address on the VPN Concentrator and a free Public address available to the PiPeline.
If you cannot do this, then try the following:
NOTE DO NOT ATTEMPT THIS ON YOUR LIVE NETWORK
Ask your ISP for a range of addresses, 2 minimum, 4 or 8 would be better.
Turn off NAT and set the Pipeline 50 to use an unnumbered ISDN link, or have it negotiate the address on dial in to the ISP.
Configure one of the registered addresses on the Pipeline 50 Ethernet port and another on the VPN Concentratoroutside port.
VPN Clients then connect to the address on the VPN Concentrator outside port as these addresses are registered and routed to you by the ISP.
You should have a Firewall between your network and the internet, unless your security policy encrypts ALL traffic through the VPN Concentrator.

by niemczyn

Browser will not come up remotely - GUI. Page Cannot Be Displayed.
How do I fix it ?

This discussion is closed to new replies.