Subject: Contivity Access

From: "Allan Kobelansky" <[email-masked]>
Date: Sun, 14 Jan 2001 22:03:19 -0500

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi,

Some time ago the following was posted ... by Terry Witherspoon
[[email-masked]]:

	I've some client PCs inside a fwtk firewall needing to
	use Nortel's Extranet Access Client to talk to a Contivity
	switch at another location. Is it possible to Proxy ipsec
	with fwtk? Any info welcome.

To which the reply from Rick Murphy [[email-masked]] was:

	Nope. IPsec uses some non-TCP protocols. About all you can do is to use
	packet filtering rules to permit AH/ESP through (and probably IKE, which
	uses UDP).

Several months had passed sine the original post and I contacted
Terry for a followup. The response he gave was:

	The secret is the external interface has to have unique
	IPs for each internally proxied IPSec session. So I made
	sure the internal Nortel users received there on IP and
	it works flawlessly.

I've asked for clarification but no response so far has been received.
Does anyone out there know how to interpret his response? Anyone interested
in giving it a try? I have the same problem to solve and would be most
appreciative if someone could elaborate a little on his response. It seems
that I am not alone since many posts have appeared with similar inquiries.

Best regards,

Allan Kobelansky