My Cisco VPN client does not work

[networkingkool]

Hi forum, My Cisco VPN client cannot connect to VPN Gateway located outsite the Internet when traffic pass through fortigate 200B. Everything else works as expectation My network topology is: My PC (VPN client) -->FG 200B (NAT)---> Linksys Loadbalancing (NAT) -->2 Internet I created a policy with nat enabled that allow LAN to connect to Internet and any Services VPN does not work Then I created one more Policy above the old policy and allow LAN to connect to Internet with Services IKE (UDP 4500/500) and UDP 10000 But the VPN doesstill not work. I think I have NAT two times and it is the reason for my trouble. Any one have idea?

[emnoc]

Diag debug flow is your friend. I would st start by diag debug flow with filters to make sure your not caught by a firewall policy rule. Also make sure your IKEv1 policy is udp_src_port/500 to udp_dst_port:500 and/or udp_src_port:any to udp_dst_port:4500 Also you didn' t mention anything about ESP, but ensure that' s open also, but if you have " ANY" open, then all of the above is irevalent. I would 1st run the diag debug and look at that output for clues, also if you haven' t done so yet, make sure the cisco vpnclient is configured and works correctly for the use, when he/she is not behind the fortigate. Could be a mis-configuration or even the far-end has ACL allowing on a certain src_ip.address.

[networkingkool]

Hi emnoc I come back. The diag debug flow command did not work. No information showed up, I mean no debug output. Here is the output of diag debug info command TRG_Firewall # diagnose debug info debug output: enable console timestamp: disable console no user log message: disable ike debug level: -1 (0xffffffff) CLI debug level: 3 Maybe I ' m running into another problem here? Back to my VPN problem, I just create an explicit policy that allow specific IKE (UDP 500/4500) and ESP service to see whether IPSEC VPN match that policy. Of course it match, but the VPN does not run. I try to uncheck the Enable Transparent Tunneling option in Cisco VPN client, the VPN work. Unchecked this option is not the default settings and not secure also, I think. So Emnoc could you please support me in this situation. Thanks in advanced

[emnoc]

Did you did the following; ( ike non-NAT ) diag debug flow dport 500 diag debug flow show console diag debug flow trace start 1000 ( ike with NAT-T ) diag debug flow dport 4500 diag debug flow show console diag debug flow trace start 1000 and diag debug enable in all above examples, if your client is working and going thru the fwpolicy you should have a match I hope that helps. Also make sure the client is NOT doing anything ridiculous like some static route to something else that exists or non-exists.

[networkingkool]

First to say thanks to your help, emnoc You give me two speparate steps above to clarify how fortigate process the packet in each VPN phases (Phase 1: ISKAMP authentication use udp port 500, Phase 2: IPSec use udp port 4500), am I right? Hi, I just want to recheck my mind in term IPsec VPN. Anyway I will check the result at next working hours

[Rick_H]

If your outbound policies allow " any" and there are no explicit deny rules higher in your policy stack blocking IPSec protocols then you might look at NAT-T configuration on your Cisco VPN. This is usually enabled by default on the Cisco head-end but sometimes needs to be manually enabled on a per-profile basis on a Cisco VPN Client.

[networkingkool]

Hi Rick, The Cisco VPN Gateway is in my customer network, therefore it is out of my control. Also I cannot find the setting on Cisco VPN Client to enable NAT-T, can you help me? I think my customer config the VPN correctly because the VPN works well when I connect through 3G network.

[Rick_H]

The NAT-T setting is on the " Transport" tab in the standard VPN Client (not the Anywhere client). Highlight your profile and click the Modify button. Then go to the Transport tab and make sure " Enable Transparent Tunneling" is ticket and then choose " IPSec over UDP (NAT/PAT)" to enable NAT-T.

[emnoc]

You really need to diag debug the flow and stop wasting time. Their' s no NAT-T option or configuration in the native cisco vpnclient that I' m aware of. It either does ike/500/4500 and tunnels ESP or uses tcp/udp-10000 and tunnels ESP, so if you have those ports and services created and/or a blanket allow ANY, then your client would work if the far end is accepting connections. note: you can set the tunnel port # on most vpnclients Also, if the client is on a remote host such as notebook, take it off your wire to a hotspot/cafe and try externally. If it works outside of your network, re-investigate your firewall or local uplink for any filters. If the above is not doable, download the pcf file into something that' s mobile and repeat the above action. But diag debug flow is really your friend here along with diag sniffer I would also double check they are not filter anything by src, or you have any other policies denying traffic from that src or possible nat issues.