NAT-T / IPSEC issues......
From: Jay (jason.anthony_at_citrix.com)
Date: 02/18/04
- Next message: sw: "Firewall blocking acess to secure (banking) sites"
- Previous message: Torgeir Bakken (MVP): "Re: How to kill a process?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 17 Feb 2004 19:19:00 -0800
I have an IPSEC policy set between a W2K3 server in a DMZ
and a W2K3 Domain Controller on the internal network.
The policy is set to use a preshared key as the
authentication method and the rule/filter set is to
secure any and all traffice between the two.
The curve ball: The Server in the DMZ has a static NAT
address assigned to it.
To test the policy put in place, I pinged the domain
controller from the server in the DMZ and a got a
successful response:
C:\>ping jayz-server
Pinging jayz-server [192.168.0.100] with 32 bytes of data:
Negotiating IP Security.
Reply from 192.168.0.100: bytes=32 time=6ms TTL=128
Reply from 192.168.0.100: bytes=32 time=5ms TTL=128
Reply from 192.168.0.100: bytes=32 time=6ms TTL=128
Also, a netmon trace showed the key exchange between the
2 servers (ISAKMP) followed by ESP traffic over UDP 4500
(NAT-T). In addition, IPSEC monitor showed successul
security associations on both ends.
The issue: I cannot seem to make successful connections
to the domain controller over any protocols/ports other
than ICMP.
Example: I tried telneting to both 80 and 3389 and both
connections failed. While attempting the telnet I had
netmon running. The trace only showed a few ESP protocol
frames sent from the server in the DMZ to the domain
controller, but there are no responses from the domain
controller (again this is not the case when I ping).
NOTE: If I turn off the static NAT on the server in the
DMZ, connections work.
I am confused on this one because that's what I though
NAT-T addressde; IPSec traffic through a NAT. Are there
some caveats that I do not know about here? Why is only
ICMP working?
Any help is appreciated,
-Jay
- Next message: sw: "Firewall blocking acess to secure (banking) sites"
- Previous message: Torgeir Bakken (MVP): "Re: How to kill a process?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
