1) You need to allow outbound isakmp (udp 500) and nat-T (udp 4500). Most VPN clients, Cisco or Notel, will use NAT-T which is udp 4500,
2) Anyone who is familar with Remote Access VPN will tell you to use IP Pool. Because I know the US military uses 126.0.0.0/24 and nobody else. Therefore, I will set the NAT pool to 126.1.1.0/22. That way, it will conflict with any RFC1918 address space so VPN will work correctly. HTH Reinhard Stich <[EMAIL PROTECTED]> wrote: hi, first of all: NAT is not a problem for an up-to-date VPN-client. there is a feature "nat traversal" that makes VPN work. but you will need more ports than only port 80 - so maybe you can allow port from this guest-dmz. the next think is that the guest-network should not be the same IP as he guest's company network. so don't use a 10.x.x.x IP - use a 172.16-32.x.x, they are not that much in use. but still there is a chance that your guest will use a 172-ip in his company network - then maybe his VPN-client is able to deal with that, if not -> bad luck. hope this helps reinhard At 02:02 25.05.2005, you wrote: >Hi Guys, > >I had a design question which I wanted to run by you guys. > >I wanted to create a VLAN for visitors and then have the checkpoint be >the gateway for the DMZ. With the appropriate rules in place, everything >seems to work for web browsing. Users are on DHCP on this vlan. > >What do you do for users who need to connect to their company network >using IPSEC vpn clients? Everything I've read seems to make this task >quite difficult. > >How have you handled this in your environment? > > >Cameron Kim > > >================================================= >To set vacation, Out-Of-Office, or away messages, >send an email to [EMAIL PROTECTED] >in the BODY of the email add: >set fw-1-mailinglist nomail >================================================= >To unsubscribe from this mailing list, >please see the instructions at >http://www.checkpoint.com/services/mailing.html >================================================= >If you have any questions on how to change your >subscription options, email >[EMAIL PROTECTED] >================================================= -- Reinhard Stich ASSIST [EMAIL PROTECTED] Internet Security AG, 1150 Wien, Johnstrasse 29 Tel: +43 1 3709440 RS784-RIPE Fax: +43 1 3709440-333 ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= --------------------------------- Do You Yahoo!? Yahoo! Small Business - Try our new Resources site! ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
