Member Avatar for maximusimo

Hi guys,

really after a bit of advice. Using at the minute a Netgear DG834 at home but need to connect to work using the Cisco VPN Client; we use a Cisco PIX Firewall at work. Turns out the DG834 wont let connect and the DG834 is the problem. i know this as never had problems connecting before switching to it and a dial-up connection lets me connect with the Client no problems.

Anyway, I want to get a new ADSL Modem/Router/Firewall in one which has IPSec Passthrough and was looking to see if someone could offer any recommendations.

Much appreciated,

Max.

  • 2 Contributors
  • 3 Replies
  • 248 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by Suspishio

Dani AI

Generated

Short take: ’s DG834 problem is almost certainly a NAT/protocol mismatch, not a Windows/Cisco-client bug. The classic confusion here is PPTP (which needs GRE/protocol 47) versus Cisco’s IPsec client (which uses IKE/ESP and NAT‑Traversal). That difference changes what the router must pass. (learn.microsoft.com)

Quick facts you can rely on

  • PPTP uses TCP/1723 plus GRE (IP protocol 47). GRE is a protocol number, not a TCP/UDP port. (learn.microsoft.com)
  • The Cisco VPN Client (and PIX/ASA headends) expect IPsec traffic: IKE/UDP 500, ESP (IP protocol 50) and—when NAT is present—NAT‑T / UDP 4500. The client has a “Transparent Tunneling → IPSec over UDP (NAT/PAT)” option to cope with NAT. (cisco.com)

What to try (in order)

  • In the Cisco VPN Client connection entry enable Transparent Tunneling → “IPSec over UDP (NAT/PAT)”, save and retest. This forces NAT‑T from the client side. (cisco.com)
  • On the DG834: update firmware and confirm any “IPSec passthrough” / “VPN passthrough” setting is enabled. If the router offers an ALG for IPSec, leave it on; if it mangles ESP, try disabling the router firewall temporarily for a test. (If direct dial-up already works, this isolates the DG834.) (cisco.com)
  • Quick diagnostic: put the PC briefly in the router’s DMZ or put the DG834 into modem/bridge mode and use a second router behind it. If the VPN then works, the DG834 is the restrictive device. (DMZ is only for testing — it lowers security.)

If you decide to replace hardware

  • Pick a small‑business router that explicitly supports IPsec NAT‑T / ESP passthrough (e.g., Cisco/Linksys RV family, DrayTek Vigor series and comparable SMB devices). These vendors document IPsec/NAT‑T support in their specs. (cisco.com)

Notes: mention ’s DrayTek suggestion — it’s a sensible option — but try the Transparent Tunneling + firmware/DG834 bridge test first; it often avoids buying new kit. Avoid leaving a PC in DMZ long-term and coordinate with your network admin to ensure the PIX/ASA is NAT‑T friendly.

Recommended Answers

All 3 Replies

Member Avatar for Suspishio

I use Draytec routers (ADSL & DSL) because there is a greater degree of certainty on using a deeper set of facilities - if you know what I mean.

Anyway, the link I've provided may provide an insught to your problem (might not though) and it is yet possible that you can configure the Netgear router to deal with the advice offered by Draytec.

I also found this useful article:
http://www.craigjconsulting.com/vpnnat.html

Member Avatar for maximusimo

Hi Suspishio,


thanks for that. Unfortunately what was stated in the Draytec page I had tried. I have also received a response from Netgear to say the that using the Cisco VPN Client requires Generic Routing Encapsulation (GRE) and the DG834 doesnt support GRE VPNs. So apart from changing things on the PIX, which i think they were saying for their post, I will have to change routers. In the even someone else has this problem I will post Netgears response on this matter:

"You are using Cisco VPN client, and as such it requires Generic Routing Encapsulation (GRE) protocol 47. See below.


GRE
(Generic Routing Encapsulation) A tunneling protocol developed by Cisco that allows network layer packets to contain packets from a different protocol. It is widely used to tunnel protocols inside IP packets for virtual private networks (VPNs). For example, the point-to-point tunneling protocol (PPTP) is based on GRE, and GRE is used with IPsec to transmit routing protocol data from one router to another, which IPsec does not natively support. See tunneling protocol, PPTP and IPsec.

The NETGEAR router does not support GRE VPNs only IPSec. See below.

VPN Functionality: NAT traversal (VPN pass-through) for IPSec, PPTP and L2TP VPNs, supports up to 5 IPSec end points.

The DG8034v3 will support a Box to Box VPN setup without GRE, this may be your best option other then that the VPN sever you are connect to will have to be edited to eliminate the GRE and be configured as a IPSec VPN server only.

There are some configuration example located at the be listed link under Popular Knowledgebase Documents.

"

Member Avatar for Suspishio

My Draytek 2800VG and 2910VG support PPTP (which uses GRE Protocol 47).

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.