Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 1 subscriber
  • Views 684 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VPN behind Astaro FW

Rainer Wittmann
I'm currently testing Astaro 2.0.16 and having trouble to connect from an L2TP/IPSec VPN-Client to a VPN-W2k-Server, which sits in the DMZ.

I've created a service group VPN with the following services:
IKE-packets: UDP 500  500
LTP: UPD 1701  1701
LTP ESP: SPI 256:4294967295
LTP AH:  SPI 256:4294967295

and added the following rule:
From: Any, Service: VPN, To: VPN-Server

Result: No connection from VPN-Client 


So I create another rule
From: Any, Service: Any, To: VPN-Server

Result: No connection from VPN-Client


Either I'm missing something or Astaro doesn't support this scenario. Does it? Any comments welcome.

Regards,

Rainer


This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to ollion
    Hi Ollion,

    I'm currently in contact with Astaro Support and they/we are working on this problem. For now it seems that the problem is caused by a fragmented ISAKMP-packet, which is silently discarded by the FW and so IKE is never sucessfully finished.
    I will post results once I have more informations.

    Regards

    Rainer
Unfiltered HTML