• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

VPN Problem

C

Chiggy

Weaksauce
Joined
Nov 23, 2003
Messages
84
Well one of the people in the company I work in can't establish a VPN into work. I think I have boiled it down to the ISP she uses but I am still not sure. I know some ISP's block IPSec, so I called them a couple of times and they have assured me they don't. What are some ways I can test to see if they do block IPSec? Or what are some security reasons an ISP would do it? I am baffled on this one.
 
Can your user ping the external interface on your company's box ( I assume ICMP is allowed) ? Find out if it's a routing issue before you start diving into protocol stuff.
 
I am pretty postive she can, but I asked her to try tonight and email me with the results. She did a packet capture while trying to establish the vpn connection and it is sending out the request just not hearing anything back. I had her diable windows firewall and connect right up to the DSL modem so there shouldn't have been any firewalls blocking anything. :confused:
 
Have her do a traceroute as well. For all we know it's failing 18 hops down the line.
 
If the tunnel is up, she probably won't be able to ping the external address.

Step 1: Verify the tunnel is up and running.
Step 2: Assuming you're doing NAT on both ends, have the user ping from their internal address to an internal address on the remote end.

If it's a point to point (gateway-to-gateway) link, look in each of the IPSec gateway's logs to see if they're speaking to each other. If it's a client-to-gateway link, make sure the client is configured correctly. Proper IP address, cryptography, etc.
 
It is a client to gateway link and we have taken her laptop and connected to it here with one of our external addresses so we know the client is configured properly. I will tell her to do the tracert as well.
 
You must log in or register to reply here.
Back
Top