Skip to main content
networkingkool
networkingkool
New Member
March 11, 2013
Question

My Cisco VPN client does not work

  • March 11, 2013
  • 3 replies
  • 6404 views
Hi forum, My Cisco VPN client cannot connect to VPN Gateway located outsite the Internet when traffic pass through fortigate 200B. Everything else works as expectation My network topology is: My PC (VPN client) -->FG 200B (NAT)---> Linksys Loadbalancing (NAT) -->2 Internet I created a policy with nat enabled that allow LAN to connect to Internet and any Services VPN does not work Then I created one more Policy above the old policy and allow LAN to connect to Internet with Services IKE (UDP 4500/500) and UDP 10000 But the VPN doesstill not work. I think I have NAT two times and it is the reason for my trouble. Any one have idea?

    3 replies

    emnoc
    emnoc
    New Member
    March 11, 2013
    Diag debug flow is your friend. I would st start by diag debug flow with filters to make sure your not caught by a firewall policy rule. Also make sure your IKEv1 policy is udp_src_port/500 to udp_dst_port:500 and/or udp_src_port:any to udp_dst_port:4500 Also you didn' t mention anything about ESP, but ensure that' s open also, but if you have " ANY" open, then all of the above is irevalent. I would 1st run the diag debug and look at that output for clues, also if you haven' t done so yet, make sure the cisco vpnclient is configured and works correctly for the use, when he/she is not behind the fortigate. Could be a mis-configuration or even the far-end has ACL allowing on a certain src_ip.address.
    networkingkool
    networkingkoolAuthor
    New Member
    March 13, 2013
    Hi emnoc I come back. The diag debug flow command did not work. No information showed up, I mean no debug output. Here is the output of diag debug info command TRG_Firewall # diagnose debug info debug output: enable console timestamp: disable console no user log message: disable ike debug level: -1 (0xffffffff) CLI debug level: 3 Maybe I ' m running into another problem here? Back to my VPN problem, I just create an explicit policy that allow specific IKE (UDP 500/4500) and ESP service to see whether IPSEC VPN match that policy. Of course it match, but the VPN does not run. I try to uncheck the Enable Transparent Tunneling option in Cisco VPN client, the VPN work. Unchecked this option is not the default settings and not secure also, I think. So Emnoc could you please support me in this situation. Thanks in advanced
    emnoc
    emnoc
    New Member
    March 13, 2013
    Did you did the following; ( ike non-NAT ) diag debug flow dport 500 diag debug flow show console diag debug flow trace start 1000 ( ike with NAT-T ) diag debug flow dport 4500 diag debug flow show console diag debug flow trace start 1000 and diag debug enable in all above examples, if your client is working and going thru the fwpolicy you should have a match I hope that helps. Also make sure the client is NOT doing anything ridiculous like some static route to something else that exists or non-exists.
    networkingkool
    networkingkoolAuthor
    New Member
    March 13, 2013
    First to say thanks to your help, emnoc You give me two speparate steps above to clarify how fortigate process the packet in each VPN phases (Phase 1: ISKAMP authentication use udp port 500, Phase 2: IPSec use udp port 4500), am I right? Hi, I just want to recheck my mind in term IPsec VPN. Anyway I will check the result at next working hours
    Rick_H
    Rick_H
    New Member
    March 14, 2013
    If your outbound policies allow " any" and there are no explicit deny rules higher in your policy stack blocking IPSec protocols then you might look at NAT-T configuration on your Cisco VPN. This is usually enabled by default on the Cisco head-end but sometimes needs to be manually enabled on a per-profile basis on a Cisco VPN Client.
    emnoc
    emnoc
    New Member
    March 15, 2013
    You really need to diag debug the flow and stop wasting time. Their' s no NAT-T option or configuration in the native cisco vpnclient that I' m aware of. It either does ike/500/4500 and tunnels ESP or uses tcp/udp-10000 and tunnels ESP, so if you have those ports and services created and/or a blanket allow ANY, then your client would work if the far end is accepting connections. note: you can set the tunnel port # on most vpnclients Also, if the client is on a remote host such as notebook, take it off your wire to a hotspot/cafe and try externally. If it works outside of your network, re-investigate your firewall or local uplink for any filters. If the above is not doable, download the pcf file into something that' s mobile and repeat the above action. But diag debug flow is really your friend here along with diag sniffer I would also double check they are not filter anything by src, or you have any other policies denying traffic from that src or possible nat issues.
    Terms & ConditionsAccessibility statement