My Weblog

Just another WordPress.com weblog

Verify VPN Pass Through is Enabled on Your Linksys Router

This article explains common reasons why trouble occurs when connecting to VPN through a Linksys router and how to troubleshoot.
Select a link below to go directly to a section:

Verify VPN Pass Through is Enabled on Your Linksys Router

Linksys Routers enable VPN Pass Through by default. To verify that VPN Pass Through is enabled, access the router’s web-based setup page. For instructions, please follow the steps below.

Step 1:
Access the router’s web-based setup page. For instructions, click here.

Step 2:
When the router’s web-based setup page appears, select VPN, and then select VPN Pass Through.

Step 3:
Make sure IPSec, PPTP, and L2TP Pass Through are all enabled. Note: If all three Pass Throughs are enabled, contact the VPN Software developer to configure the software behind a router.

Step 4:

Select

Disable Block WAN Request and Set to Gateway Mode

After finishing VPN tunnel and IPSec set up, go to Firewall and then General page on remote gateway and disable Block WAN Request. This will prevent the ICMP package from being blocked and the remote gateway from being unreachable.

Disabling Block WAN request on Firewall General page

Also, make sure that both routers are working on Gateway mode and routing protocol RIP is disabled. In router mode, any computer connected to the router will not be able to connect to the internet unless you have another router as gateway.

Selecting Gateway working mode on Setup Advanced Routing page

Check Reachability of VPN Devices

Before making connection on VPN tunnel at VPN Summary page, it is important to check the reachability of VPN devices. If the WAN IP address of remote gateway/client can not be pinged by local gateway/client, or WAN IP address of local gateway/client can not be pinged by remote gateway/client, VPN tunnel can not be created; network configuration should be checked instead.

Ping remote gateway before VPN connection.

Remote gateway can be reached successfully before VPN connection

After VPN connected successfully, remote host can be pinged.

Remote host can be reached after VPN connected successfully

Allow ICMP Pass Through on Remote Host Firewall

If remote host can not be pinged but the VPN tunnel is connected as indicated on VPN summary page, check the firewall setting on remote host.

Step 1: For Windows, select Start, then select Control Panel.
Step 2: Select Windows Firewall.
Step 3: Select the Off button to disable firewall.

Alternative:

Step 1: For Windows, select Start, then select Control Panel.
Step 2: Select Windows Firewall, and then select the Advanced tab.
Step 3: Select the appropriate Network Connection Settings.

Network Connection Settings

Step 4: Select the Settings… button in the Network Connection Settings section and then select the Advanced tab.
Step 5: Check the box next to Allow incoming echo request and then select OK.

Network Firewall Configuration on VPN

If remote gateway can not be reached or VPN connection set up fails, network firewall settings should be checked. Please contact your network administrator to allow ISAKMP traffic on your company’s firewall. Company firewall should be configured properly to allow ISAKMP package, critical messages for VPN IPSec set up, pass through. Below is an example of PIX Firewall configuration. An entry (highlighted in red) is created on access-list that permits isakmp traffic, which uses UDP port 500. Without this entry, VPN connection will be fail due to firewall blocking.

An example of PIX firewall configuration that allows isakmp package pass through
( Source: “CCIE Security Practice Labs”, Author: Yusuf Bhauji, Cisco Press, 2004)

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: