Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm attempting to connect to a VPN (L2TP over IPsec) server through (not to) a WatchGuard XTM 505 appliance.

I have the VPN server setup behind the firewall on a 1-to-1 NAT, and other protocols (such as HTTP traffic) are forwarded to that server just fine. Also, VPN connections to the machine work perfectly from behind the firewall (i.e. from the LAN).

I've made "Enabled and Available" the following policies to the VPN server:

  • L2TP (opens UDP 1701)
  • IPsec (opens UDP 500, UDP 4500, AH and ESP)
  • PPTP (opens TCP 1723 and GRE)

Yet whenever connecting from outside, I see the following logs from the XTM console:

2011-12-27 16:24:08 iked ******** RECV an IKE packet at 1.2.3.4:500(socket=11 ifIndex=4) from Peer 123.123.123.123:48165 ********   Debug
2011-12-27 16:24:08 iked IkeFindIsakmpPolicy: -->   Debug
2011-12-27 16:24:08 iked Failed to find phase 1 policy for peer IP 123.123.123.123      Debug
2011-12-27 16:24:08 iked IkeFindIsakmpPolicy: <--   Debug
2011-12-27 16:24:08 iked ike_process_pkt : IkeFindIsakmpPolicy failed       Debug

So it seems as if the Firebox is not forwarding this traffic to the 1-to-1 NAT as it should be; rather it seems to attempting to act as the VPN server itself, intercepting the IKE request (but failing because I haven't configured it for VPN).

What am I missing? Is there some setting to force the firewall to forward VPN connection attempts along the NAT? Do I have to pre configure some sort of tunnel between the firewall and the VPN server? Perhaps I need to add a static route of some sort?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

In VPN -> VPN Settings, there is an IPSec pass-through option that must be enabled:

It appears that WatchGuard intends this to be used for outbound IPSec VPN connections (from LAN clients to WAN endpoints). To make this work for inbound connections, at minimum you will need to modify the automatically generated IPSec rules to allow inbound connections instead of or in addition to outbound connections.

I would also suggest setting a policy-based NAT on your IKE rule for UDP port 500.

Reference: WSM Manual

share|improve this answer
    
Both enabling IPsec Pass-through and modifying the IPsec policy to allow incoming connections have already been attempted (and, in fact, both of those configurations were effect when the above logs were generated). –  Chris Jan 5 '12 at 20:17
    
OK. Did you try the policy-based NAT? –  Skyhawk Jan 5 '12 at 20:17
    
By policy-based NAT, are you referring to the "Dynamic NAT" option under the "Advanced" tab in the policy details? If so, I have both 1-to-1 NAT and Dynamic NAT enabled. –  Chris Jan 5 '12 at 20:19
    
On the inbound rule that allows traffic for port 500, set the destination IP address to a NAT (choose NAT in the drop-down list instead of Host). For example, if the external IP address is 203.0.113.34 and the internal IP address is 192.0.2.49, the destination column in Policy Manager will say "203.0.113.34 -> 192.0.2.49" if you have configured a policy-based NAT. –  Skyhawk Jan 5 '12 at 23:20
1  
Bizarre. Has Watchguard support weighed in? (p.s. If you are looking for a firewall that's beauiful like a clean Rails project, WatchGuard isn't it. Try Palo Alto Networks.) –  Skyhawk Jan 6 '12 at 18:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.