<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
--></style>
</head>
<body class='hmmessage'>
Hi, this is my situation: I have a lot of laptops that have to connect at the same time from different countries to my network. Some ras operators (for example vodafone IT) give them a pubblic IP, other (swisscom CH) give them a natted IP.<BR>
<BR>
<BR>
|LAPTOP| -- ras connection --> IP ADDR assigned 10.141.179.32 |<BR>
|<BR>
| -- IP ADDR natted 193.247.250.11 --> |L2TP/IPSEC SERVER (213.100.100.1)|<BR>
|LAPTOP| -- ras connection --> IP ADDR assigned 10.141.179.43 |<BR>
<BR>
<BR>
----------------------------------------------------------------------------------------<BR>
My configuration is:<BR>
<BR>
version 2.0 # conforms to second version of ipsec.conf specification<BR>
config setup<BR> interfaces=%defaultroute<BR> klipsdebug=none<BR> plutodebug=none<BR> nat_traversal=yes<BR> protostack=netkey<BR>
<BR>
conn vpnagenti<BR> authby=secret<BR> pfs=no<BR> type=transport<BR> auto=add<BR> left=213.100.100.1<BR> leftprotoport=17/1701<BR> right=%any<BR> rightprotoport=17/1701<BR> keyexchange=ike<BR> ikelifetime=8h<BR> keylife=1h<BR> keyingtries=3<BR> rekey=no<BR><BR>
include /etc/ipsec.d/*.conf<BR>include /etc/ipsec.d/examples/no_oe.conf<BR>--------------------------------------------------------------------------------------<BR>
<BR>
This configuration works if the clients aren't behind NAT, but they have a pubblic IP.<BR>
<BR>
If the ras operator takes a private IP and then it nats it, I have this message:<BR>
<BR>
14:30:31.248758 IP 193.247.250.11.time > 213.100.100.1.isakmp: isakmp: phase 1 I ident<BR>14:30:31.249830 IP 213.100.100.1 > 193.247.250.11: icmp 348: 213.100.100.1 udp port isakmp unreachable<BR>14:30:31.651442 IP 193.247.250.11.time > 213.100.100.1.isakmp: isakmp: phase 1 I ident<BR>14:30:31.651681 IP 213.100.100.1 > 193.247.250.11: icmp 348: 213.100.100.1 udp port isakmp unreachable<BR>14:30:32.615081 IP 193.247.250.11.time > 213.100.100.1.isakmp: isakmp: phase 1 I ident<BR>14:30:32.615128 IP 213.100.100.1 > 193.247.250.11: icmp 348: 213.100.100.1 udp port isakmp unreachable<BR><BR>
Could you help me?<BR>
Thanks<BR><BR>
Massimiliano<BR> <br /><hr />Lo spazio su Hotmail aumente con le tue esigenze... <a href='http://www.windowslive.it/hotmail/SpazioDisponibile.aspx' target='_new'>Vai oltre i 5GB</a></body>
</html>