Hi!
I'm trying to figure out how I can get this scenario working:
CISCO 831 (Router) --> ASG (gatekeeper1) --> DMZ --> ASG (gatekeeper2) --> LAN
My intention is to get a client-to-site VPN (ipsec) up and running (roardwarrior with dynamic ip should have access to my local LAN).
First of all the cisco has to be able to let ipsec packets through. I'm still on getting this to work, as it seems that packets still don't pass the cisco to gatekeeper1.
My question I would like to ask you is: what packet-rules do I have to set on gatekeeper1 to let all ipsec-related traffic pass through it?
What I did so far is: I created a servicegroup "SG-ipsec" with the following services included: ipsec_ah, ipsec_esp, ipsec_ip and ipsec_isakmp which have to following details:
ipsec_ah: proto: AH, source/dest-ports: 256:4294967295
ipsec_esp: proto: ESP, source/dest-ports: 256:4294967295
ipsec_ip: proto: IP, source/dest-ports: 50
ipsec_isakmp: proto: udp, sourceport: 500, destport: 500
All right, is this the way the gatekeeper1 could let all the ipsec-relatet packets pass??
Or are these rules wrong all the way?
gatekeeper2 is already configured to accept VPN connections, ipsec is set up already.
If I missed any important information pls let me know, I will then pass it on right away.
Hope anyone knows something... ;-)
Michael
This thread was automatically locked due to age.
