VPN Client and FireBox II

  • Thread starter Thread starter Dumitru Ozunu
  • Start date Start date
D

Dumitru Ozunu

Hello again,

I have a problem using a Nortel VPN Client. I'm using a W2K SP4 machine, the
VPN client v04_61.18 installs without problems, I'm using a softoken, but
the connection fails (the user grup and password are correct, the UID and
generated softoken are also OK). I'm trying this since 1 week and is driving
me nuts.The W2K machine on which the Nortel VPN Client runs is behind a
Firebox II thing. What should I do to have the client run? Here is the log
file from my VPN Client (I think there is a problem with the NAT, please
help...

Wed Nov 26 09:59:52 2003 | Isakmp | I | Logging subsystem initialized.
Wed Nov 26 10:00:04 2003 | Isakmpd | I | Connection initiated to 194.x.x.x
[194.x.x.x] using Diffie-Hellman group 2.
Wed Nov 26 10:00:09 2003 | Isakmpd | F | Login failed. Please consult the
switch log for further information.
Wed Nov 26 10:00:24 2003 | Isakmpd | I | Connection initiated to
194.x.x.x[194.x.x.x] using Diffie-Hellman group 2.
Wed Nov 26 10:00:26 2003 | ConfMode | S | Authentication successful.
Wed Nov 26 10:00:26 2003 | ConfMode | I | IP Address 10.y.y.y.
Wed Nov 26 10:00:26 2003 | ConfMode | I | Keepalive interval set to 60
seconds.
Wed Nov 26 10:00:26 2003 | ConfMode | I | Maximum keepalive retransmissions
set to 3 retries.
Wed Nov 26 10:00:26 2003 | ConfMode | I | Mandatory tunneling enforced.
Wed Nov 26 10:00:26 2003 | ConfMode | I | Domain name set to "a.b.com".
Wed Nov 26 10:00:26 2003 | ConfMode | I | Primary Domain Name Server
"10.y.x.z".
Wed Nov 26 10:00:26 2003 | ConfMode | I | Secondary Domain Name Server
"10.x.f.g".
Wed Nov 26 10:00:26 2003 | ConfMode | I | Primary WINS Server "10.f.g.h".
Wed Nov 26 10:00:26 2003 | ConfMode | I | Secondary WINS Server "10.d.e.g".
Wed Nov 26 10:00:26 2003 | ConfMode | I | Saving Password on client is
turned Off.
Wed Nov 26 10:00:26 2003 | ConfMode | I | NAT Traversal invoked.
Wed Nov 26 10:00:26 2003 | ConfMode | I | Received NAT Keepalive value of 8
seconds from switch.
Wed Nov 26 10:00:26 2003 | ConfMode | I | Current time on switch is 11/26/03
10:00:25 GMT.
Wed Nov 26 10:00:29 2003 | NameSrvr | W | Adding DNS Servers "10.s.d.g.g.d".
Wed Nov 26 10:00:30 2003 | NameSrvr | W | Adding WINS Servers
"10.a.f.f*10.a.f.r".
Wed Nov 26 10:00:31 2003 | Failover | W | Failover list set to none.
Wed Nov 26 10:01:27 2003 | Isakmpd | F | The secure Contivity VPN connection
has been lost.
Click Connect to re-establish the connection.

as I've read in the help file, there is a problem with the NAT Traversal and
I have no ideea how to configure the FireBox II stuff...the problem is by
the FireBox that lies behind (NAT Traversal doesn't function properly, i.e
the client finds the server but then the server cannot find back the calling
client)
Does anybody have some experience with this problem, i.e. Nortel VPN Client
and FireBox II
from WatchGuard?
thanx again,
mitru
 
Hello again,

I have a problem using a Nortel VPN Client. I'm using a W2K SP4 machine, the
VPN client v04_61.18 installs without problems, I'm using a softoken, but
the connection fails (the user grup and password are correct, the UID and
generated softoken are also OK). I'm trying this since 1 week and is driving
me nuts.The W2K machine on which the Nortel VPN Client runs is behind a
Firebox II thing. What should I do to have the client run? Here is the log
file from my VPN Client (I think there is a problem with the NAT, please
help...

Wed Nov 26 09:59:52 2003 | Isakmp | I | Logging subsystem initialized.
Wed Nov 26 10:00:04 2003 | Isakmpd | I | Connection initiated to 194.x.x.x
[194.x.x.x] using Diffie-Hellman group 2.
Wed Nov 26 10:00:09 2003 | Isakmpd | F | Login failed. Please consult the
switch log for further information.
Wed Nov 26 10:00:24 2003 | Isakmpd | I | Connection initiated to
194.x.x.x[194.x.x.x] using Diffie-Hellman group 2.
Wed Nov 26 10:00:26 2003 | ConfMode | S | Authentication successful.
Wed Nov 26 10:00:26 2003 | ConfMode | I | IP Address 10.y.y.y.
Wed Nov 26 10:00:26 2003 | ConfMode | I | Keepalive interval set to 60
seconds.
Wed Nov 26 10:00:26 2003 | ConfMode | I | Maximum keepalive retransmissions
set to 3 retries.
Wed Nov 26 10:00:26 2003 | ConfMode | I | Mandatory tunneling enforced.
Wed Nov 26 10:00:26 2003 | ConfMode | I | Domain name set to "a.b.com".
Wed Nov 26 10:00:26 2003 | ConfMode | I | Primary Domain Name Server
"10.y.x.z".
Wed Nov 26 10:00:26 2003 | ConfMode | I | Secondary Domain Name Server
"10.x.f.g".
Wed Nov 26 10:00:26 2003 | ConfMode | I | Primary WINS Server "10.f.g.h".
Wed Nov 26 10:00:26 2003 | ConfMode | I | Secondary WINS Server "10.d.e.g".
Wed Nov 26 10:00:26 2003 | ConfMode | I | Saving Password on client is
turned Off.
Wed Nov 26 10:00:26 2003 | ConfMode | I | NAT Traversal invoked.
Wed Nov 26 10:00:26 2003 | ConfMode | I | Received NAT Keepalive value of 8
seconds from switch.
Wed Nov 26 10:00:26 2003 | ConfMode | I | Current time on switch is 11/26/03
10:00:25 GMT.
Wed Nov 26 10:00:29 2003 | NameSrvr | W | Adding DNS Servers "10.s.d.g.g.d".
Wed Nov 26 10:00:30 2003 | NameSrvr | W | Adding WINS Servers
"10.a.f.f*10.a.f.r".
Wed Nov 26 10:00:31 2003 | Failover | W | Failover list set to none.
Wed Nov 26 10:01:27 2003 | Isakmpd | F | The secure Contivity VPN connection
has been lost.
Click Connect to re-establish the connection.

as I've read in the help file, there is a problem with the NAT Traversal and
I have no ideea how to configure the FireBox II stuff...the problem is by
the FireBox that lies behind (NAT Traversal doesn't function properly, i.e
the client finds the server but then the server cannot find back the calling
client)
Does anybody have some experience with this problem, i.e. Nortel VPN Client
and FireBox II
from WatchGuard?
thanx again,
mitru
Click to expand...

I've got several FB-II units and found that many vendors VPN Clients do
not function well. This is not specific to WatchGuard, it's about the
same with many vendors - if you use the WG Client it would work, but
that probably is not possible?

One other thing - the subnet that you are using on your end can not be
the same subnet that's behind the firebox.

If you can't get it working, do a PPTP connection to the FB itself.
 
Back
Top