Re: Not another NAT question.. Yes I'm Sorry

Does the Netgear support more than one IPSEC device behind it??
check the docs.

i know the old RT311 did not.

in my previous experience this what i have seen happen in a working 
environment.

the NAT'd IPSec client uses UDP-E, basically an ESP packet with a UDP 
header with a source and dest port of 500 (IKE). usually the NAT device 
will modify the source port as it processes the packet, what cisco likes 
to call PAT ( port address translation ).  when it is passed out the 
public side it will have source port > 1024 and dest port of 500.

for example

[NATclientIPSEC] ---> udp(src=500&dst=500) ---> {NAT-Router) 
->udp(src=>1024&dst=500)

sorry for terrible drawing.

this is to help NAT table map the packet back to the private address.

your netgear device might not being modifying the source port which in 
turn would allow only 1 ipsec device to talk to a single termination 
point.

i would love to look at a network capture ( any format ), just take out 
relevant IP info.

i hope i am on the right track and this helps.  also look into firmware 
upgrades and documentation on the Netgear, if any available.


cs



Neo wrote:
> I have a client using a Netgear FVS328 VPN Router.
>  
> Runs NAT.
>  
> The internal workstations use Netscreen Remote VPN client. I cannot get 
> more than one workstation connected at a time. If a user  is in and 
> another connects, the new user boots out the existing user and now that 
> user is in.
>  
> I am trying to understand somethings by reading but if someone could 
> help me out I would very much appreciate it.
>  
> What I would like to know is, can this router or the VPN client somehow 
> get around this obvious limitation. NAT Traversal?
>  
> If I have left out any needed info let me know.
> 
> //
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> VPN mailing list
> [email protected]
> http://lists.shmoo.com/mailman/listinfo/vpn