Most likely a problem on the NAT box. I'm guessing that both users are trying to use stanadard IPSec protocol for IKE and ESP. The problem is the NAT box knows about IPSec, and maps incoming IPSec to a certain inside device. But when the second client establishes a connection, the NAT box no longer knows what inside client to send it to, so the first one gets dropped. Have one (or both) of the clients change to a tunneled mode (over TCP or UDP), and the problem should go away.
Chuck Church Principal Network Engineer, CCIE #8776 Harris Information Technology Services EDS Contractor - Navy Marine Corps Intranet (NMCI) 1210 N. Parker Rd. | Greenville, SC 29609 Office: 864-335-9473 | Cell: 864-266-3978 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark Messier Sent: Wednesday, September 26, 2007 9:44 AM To: [email protected] Subject: [c-nsp] pix vpn problem Hello, A customer has a Cisco Pix (6.3) with remote users using the cisco vpn client. When they have two remote people behind the same NAT box (which we don't control, perhaps in a hotel) then only one of them can be connected at a time. When the second tries to connect, the first gets disconnected. Is this likely to be a problem with the (unknown) NAT box, or on the PIX? If on the PIX, is it fixable? Thanks, -mark _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
