Dan18960
08-02-2006, 08:03 AM
OK gurus here is one that is DRIVING me crazy.
Client has a VLan configuration with 12 Vnodes numbering from 10.1.1 to 10.1.12. MY CLIENT needs to setup a VPN that creates a tunnel between their SOHO3 on site to a SW Pro 1260 at the central office.
In the "perfect" solution - I would have a WAN ip handed off via a switch on the T-1 side and I would negotiate the VPN directly. But this client has me going through their ISA server which is handling 4 other vpns and login designates which pre-designated vpn you are granted by the IIS servers ISA assignments. The problem that is created is that the Pro or the SOHO can "not" login since they are a point to point vpn creation and no logging is able to be configured.
The other issue is that ALL vpns use port 500 and 4500 repectively with protocol 17 setting up 50/51 to act as the negotiating incoming and outgoing.
WE have tried setting up the IIS server to accept the vpn request and included the internal "WAN" ip to respond as appropriate - but because of the hops the IKE is timing out on authentication. We moved the WAN ip down the chain so that the SOHO was in the first vpn assignments of 10.1.1 but the timing is still an issue. We have release ALL restrictions thinking that the firewall settings were interferring with the authentication exchange.
We have forwarded requests from the Destination to the source assigned wan - no go. We are looking at scripting to see if that will setup the vpn.
So what are the consensus out there to get a hardware vpn to cooperate within an IIS / ISA firewall? ? ? ?
Client has a VLan configuration with 12 Vnodes numbering from 10.1.1 to 10.1.12. MY CLIENT needs to setup a VPN that creates a tunnel between their SOHO3 on site to a SW Pro 1260 at the central office.
In the "perfect" solution - I would have a WAN ip handed off via a switch on the T-1 side and I would negotiate the VPN directly. But this client has me going through their ISA server which is handling 4 other vpns and login designates which pre-designated vpn you are granted by the IIS servers ISA assignments. The problem that is created is that the Pro or the SOHO can "not" login since they are a point to point vpn creation and no logging is able to be configured.
The other issue is that ALL vpns use port 500 and 4500 repectively with protocol 17 setting up 50/51 to act as the negotiating incoming and outgoing.
WE have tried setting up the IIS server to accept the vpn request and included the internal "WAN" ip to respond as appropriate - but because of the hops the IKE is timing out on authentication. We moved the WAN ip down the chain so that the SOHO was in the first vpn assignments of 10.1.1 but the timing is still an issue. We have release ALL restrictions thinking that the firewall settings were interferring with the authentication exchange.
We have forwarded requests from the Destination to the source assigned wan - no go. We are looking at scripting to see if that will setup the vpn.
So what are the consensus out there to get a hardware vpn to cooperate within an IIS / ISA firewall? ? ? ?