vpn [dial-up .vs. lan]

[sirca]

Hi!!
You remember my issue with ipsec vpn client .....
Today with the GreenBow I can to establish a vpn tunnel but...
If I try to connect to secure gateway via a dial-up connection, the tunnel can be established, but if I try from my workplace lan the ike/vpn messages not reach the gateway.

I try to explain better...
notebook->dial-up(56k)->ISP_A->Internet->ISP_A->adsl->router_A->gateway is functioning
notebook->lan->router_B->ISP_B->Internet->ISP_A->adsl->router_A->gateway is NOT functioning

Note that in first scenario the ISP is the same, in second scenario the ISPs are different. The router_A is my Linksys WAG200G with port forwarding towards the gateway, a Clavister SG51. The notebook is the same with the same vpn configuration. The big difference between two scenarios is that in first I have only a NAT between router_A and my home private LAN, in second there are two NAT between the private workplace lan and the router_B/ISP_B address and between the adsl/router_A address and my private home lan.
I known that NAT is the great enemy of ipsec but I think with the NAT-Traversal it is possible, but I dont know if is possible with two NAT.
Any ideas??
Thank you in advance
Best regards from Rome
Andrea

 

[YeOldeStonecat]

Firewall at your workplace LAN?

 

[sirca]

again on line but....

I am absolutely sorry for inexcusable delay in reply....recently I try to establish a new ipsec-tunnel from my workplace to my home, and the issues cme back!!
Configuration and ipsec appliace/ipsec client are the same:
clavister sg51, linksys wag200g and green bow client.
Again I have "two nat": from the notebook to internet and from internet to router and there are not rules to block ports in workplace firewall.
If I try from integrated 56kmodem in notebook to my home it is functioning, but if I try from a "natted" network to my home (again "natted") is NOT functionig (you con see the schema in first post of this thread).
Do you think can be an issue with the double nat??
Again, my green bow license is expired and before purchase it I would try other windows vista ipsec client...do you know any of that.
I can use SSL Explorer as detailed in SmallNetBuilders article but I would use ipsec having an appliance supporting that.
Thank you in advance and sorry again for the delay in replay.
Best Regards from Rome
Andrea