Setting up a L2TP/IPsec VPN

[Razerback]

Hi All,

Im trying to setup a L2TP/IPsec VPN behind our PA FW, using RRAS.

I have allowed application ipsec and i can see that port 500 and 4500 are being allowed when i attempt to connect.

I have also set up NAT rules for ports 500,4500,1701 from untrust zone to untrust zone destination translation internal RRAS server. when I try to connect to the VPN it will just spin and end up returning an error stating that a device between myself and the VPN server is not allowing the connection. Has anyone had any experience setting this type of VPN up? any info would be much appreciated.

Thanks

[jdelio]

Whenever you are trying to get a new service/application thru the firewall, sometimes it is hard to know exactly what is being allowed and what is blocking and thus causing any issues.

I would say you have to options:

1. Open the rule to all ports to see if that allows this to work.. if so, then look at the ports used and then limit to those ports.

or

2. Examine your logs for drops and see if any ports need to be added to the current rule.

This should start you in the right direction.