How to setup a VPN connection over a Natted connection

[roadrunner]

How to setup a VPN connection over a Natted connection
Since the massive installation of ADSL worldwide, which provides a stable connection to the Internet, some corporations have been looking at the possibility of setting up a VPN-NET connection to a remote office over ADSL.

The company one reader works for has offices in Spain. Unfortunatly, Telefonica is only allowed to provide 1 IP number per ADSL connection. The implementation that the reader had needed at least a /30 due to the fact that we installed a new ADSL router. The current setup that we have is based upon a Cisco 827 router and an IPSO 120. Here is a dump of the cisco config:


! -----------------------------
! version 12.2 no service pad service timestamps debug uptime service timestamps log uptime service password-encryption
! hostname XXXXXXXXXXXXXXX
! no logging buffered enable secret 5 XXXXXXXXXXXXXXXXXXXX
! username XXXXXXXXXX password 7 XXXXXXXXXXXXXXXX ip subnet-zero ip name-server 123.123.123.123
!
!
!
! interface Ethernet0

!------------------
! Private non routable IP address used for Cisco -> IPSO communication
!------------------
ip address 192.168.1.1 255.255.255.0
ip nat inside
hold-queue 100 out

! interface ATM0

no ip address
no atm ilmi-keepalive
dsl operating-mode auto

! interface ATM0.1 point-to-point

!------------------
! Public IP number if ISP is providing RFC 1483 Should you need PPPoA or PPPoE then just e-mail me
!------------------
ip address
ip nat outside
pvc 8/32
protocol ip
!

! ip nat inside source list 102 interface ATM0.1 overload
!------------------ ! IP number of the IPSO box
!------------------ ip nat inside source static 192.168.1.2 interface ATM0.1 ip classless ip route 0.0.0.0 0.0.0.0 ATM0.1 no ip http server
!
! access-list 23 permit access-list 23 permit access-list 102 permit ip 192.168.1.0 0.0.0.255 any ! line con 0

exec-timeout 120 0
stopbits 1

line vty 0 4

access-class 23 in
exec-timeout 120 0
login local
length 0

! scheduler max-task-time 5000 end ! -----------------------------
Answer


--------------------------------------------------------------------------------
All you have to do now is create a new gateway on your VPN-PRO module and update your FW-1 management rules (either global properties based or self made) to connect to the PUBLIC ip number of the ADSL connection. Upload this config and after it has been successfully loaded convert the gateway to a checkpoint gateway.
--------------------------------------------------------------------------------

-- RobertGraham - 07 Jan 2004


FAQForm
FAQs.Class: EncryptionFAQs
FAQs.OS:
FAQs.Version: