I'm attempting to connect to a VPN (L2TP over IPsec) server through (not to) a WatchGuard XTM 505 appliance.

I have the VPN server setup behind the firewall on a 1-to-1 NAT, and other protocols (such as HTTP traffic) are forwarded to that server just fine. Also, VPN connections to the machine work perfectly from behind the firewall (i.e. from the LAN).

I've made "Enabled and Available" the following policies to the VPN server:

  • L2TP (opens UDP 1701)
  • IPsec (opens UDP 500, UDP 4500, AH and ESP)
  • PPTP (opens TCP 1723 and GRE)

Yet whenever connecting from outside, I see the following logs from the XTM console:

2011-12-27 16:24:08 iked ******** RECV an IKE packet at ifIndex=4) from Peer ********   Debug
2011-12-27 16:24:08 iked IkeFindIsakmpPolicy: -->   Debug
2011-12-27 16:24:08 iked Failed to find phase 1 policy for peer IP      Debug
2011-12-27 16:24:08 iked IkeFindIsakmpPolicy: <--   Debug
2011-12-27 16:24:08 iked ike_process_pkt : IkeFindIsakmpPolicy failed       Debug

So it seems as if the Firebox is not forwarding this traffic to the 1-to-1 NAT as it should be; rather it seems to attempting to act as the VPN server itself, intercepting the IKE request (but failing because I haven't configured it for VPN).

What am I missing? Is there some setting to force the firewall to forward VPN connection attempts along the NAT? Do I have to pre configure some sort of tunnel between the firewall and the VPN server? Perhaps I need to add a static route of some sort?


In VPN -> VPN Settings, there is an IPSec pass-through option that must be enabled:

It appears that WatchGuard intends this to be used for outbound IPSec VPN connections (from LAN clients to WAN endpoints). To make this work for inbound connections, at minimum you will need to modify the automatically generated IPSec rules to allow inbound connections instead of or in addition to outbound connections.

I would also suggest setting a policy-based NAT on your IKE rule for UDP port 500.

Reference: WSM Manual

  • Both enabling IPsec Pass-through and modifying the IPsec policy to allow incoming connections have already been attempted (and, in fact, both of those configurations were effect when the above logs were generated). – Chris Tonkinson Jan 5 '12 at 20:17
  • OK. Did you try the policy-based NAT? – Skyhawk Jan 5 '12 at 20:17
  • By policy-based NAT, are you referring to the "Dynamic NAT" option under the "Advanced" tab in the policy details? If so, I have both 1-to-1 NAT and Dynamic NAT enabled. – Chris Tonkinson Jan 5 '12 at 20:19
  • 1
    Didn't work. Same IKE log messages as before. – Chris Tonkinson Jan 6 '12 at 13:30
  • 1
    Bizarre. Has Watchguard support weighed in? (p.s. If you are looking for a firewall that's beauiful like a clean Rails project, WatchGuard isn't it. Try Palo Alto Networks.) – Skyhawk Jan 6 '12 at 18:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.