you have luck! I have just received a request to test a Cisco VPN client through a back-to-back DMZ scenario to a Cisco 3000 VPN Concentrator. As inner firewall we use an ISA server and as outer firewall a Checkpoint. So, it is the first time I will have the chance to test it myself !
Therefore, I have started studying that Cisco article in more depth, particular the Cisco VPN client logging. I did also receive an example of a client logging for a working NAT-T VPN connection through a Cisco NAT device. What have I learned so far?
In the first IKE message the client (Inititiator) should announce his NAT-T capability:
SENDING : ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Nat-T), VID(Frag), VID(Unity)) to 18.104.22.168
Likewise, the responder should do the same in his first IKE response and include the NAT-D payloads (aggressive mode):
RECEIVING : ISAKMP OAK AG (SA, KE, NON, ID, HASH, VID(Unity), VID(Xauth), VID(dpd), VID(Nat-T), NAT-D, NAT-D, VID(Frag), VID(?), VID(?)) from 22.214.171.124
In the logging you should then find an entry:
Peer supports NAT-T
After that, the Initiater (Cisco client) sends his NAT-D payloads:
SENDING : ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, NAT-D, NAT-D, VID(?), VID(Unity)) to 126.96.36.199
... and move the IKE and following traffic to the new NAT-T UDP port 4500:
IKE Port in use - Local Port = 0x1194, Remote Port = 0x1194
Automatic NAT Detection Status:
Remote end IS behind a NAT device
This end IS behind a NAT device
Now, if I look in your logging I don't find that sequence at all! So, unless you have not enabled the full logging in the Cisco VPN client, I can only conclude that the client does not even propose the NAT-T capability. In other words, if you look into the ISA Firewall log you will only find traffic on UDP port 500, and in the IP packet filter log you should see blocked packet for IP protocol 50 and/or 51. With the available info, definitely a Cisco VPN client and/or gateway configuration problem.
[ December 07, 2003, 11:49 AM: Message edited by: spouseele ]