L2TP/IPSec VPN Windows Server 2003

I have setup a test environment where I have a:
1. 2003 DC,DNS,DHCP,WINS,Certifiate server.
2. 2003 VPN server - 2NICs, RRAS
3. Windows XP Client (SP2) connecting with client certificate

All works OK if VPN server Internet NIC exposed on the Internet
Does not work if Cisco 871W router/firewall/NAT installed
Have tried many different scenarios with no change in the results.
Would like to have the Cisco 871W router provide all the port security & not
expose the VPN server to the Internet.

Any extra lightbulb ideas appreciated.

Thanks in advance.

Kevnanh,

Are we using IPSEC/L2TP? or MPPE/PPTP?

On the Cisco you will need to pulish IKE UDP 500 and ESP protocol ID 50 for
L2TP with IPSec. You may need UDP 1701 for the connection depending on your
setup (need more info possibly).

For PPTP - Protocol ID 47 GRE packets- the tunnel for PPTP data packets and
TCP 1723 for the PPTP connection.

You need to forward these port- check your IOS version to see what you can
support. These are the only ports and protocols you need for the VPNs.

alex k
"kevanh" wrote:

> I have setup a test environment where I have a:
> 1. 2003 DC,DNS,DHCP,WINS,Certifiate server.
> 2. 2003 VPN server - 2NICs, RRAS
> 3. Windows XP Client (SP2) connecting with client certificate
>
> All works OK if VPN server Internet NIC exposed on the Internet
> Does not work if Cisco 871W router/firewall/NAT installed
> Have tried many different scenarios with no change in the results.
> Would like to have the Cisco 871W router provide all the port security & not
> expose the VPN server to the Internet.
>
> Any extra lightbulb ideas appreciated.
>
> Thanks in advance.

Thanks for the reply,
I have already completed all the port forwarding & opened the appropiare
ports required.

I believe that this is a much more advanced issue...currently I have been
recommended to get 2 fixed IPs from the ISP & do Nat on the inside unterface.
Will post any other results as I get them


"alexk" wrote:

>
> Kevnanh,
>
> Are we using IPSEC/L2TP? or MPPE/PPTP?
>
> On the Cisco you will need to pulish IKE UDP 500 and ESP protocol ID 50 for
> L2TP with IPSec. You may need UDP 1701 for the connection depending on your
> setup (need more info possibly).
>
> For PPTP - Protocol ID 47 GRE packets- the tunnel for PPTP data packets and
> TCP 1723 for the PPTP connection.
>
> You need to forward these port- check your IOS version to see what you can
> support. These are the only ports and protocols you need for the VPNs.
>
> alex k
> "kevanh" wrote:
>
> > I have setup a test environment where I have a:
> > 1. 2003 DC,DNS,DHCP,WINS,Certifiate server.
> > 2. 2003 VPN server - 2NICs, RRAS
> > 3. Windows XP Client (SP2) connecting with client certificate
> >
> > All works OK if VPN server Internet NIC exposed on the Internet
> > Does not work if Cisco 871W router/firewall/NAT installed
> > Have tried many different scenarios with no change in the results.
> > Would like to have the Cisco 871W router provide all the port security & not
> > expose the VPN server to the Internet.
> >
> > Any extra lightbulb ideas appreciated.
> >
> > Thanks in advance.