I'm trying to figure out how to setup multiple IPsec VPN tunnels, and before I spend any money on hardware, I want to make sure I'm understanding this correctly.

My plan is to setup a Vyatta Core server with a static IP address to be one endpoint of the IPsec VPN. Then, I will have 2 Cisco RV042's in different locations that will connect with the Vyatta server. Theoretically, I think this should be fine. The problem is the Cisco RV042's will have Dynamic IP addresses. One of them will be behind multiple layers of NAT and behind a firewall, which I will have no access to change settings on.

Is this going to work? If not, are there any alternatives?

2 Answers 2


IPSEC with nat-traversal turned on (upd header added) works with most setups simmilar yours. Depending on the firewall settings, this might also be blocked/disallowed, so there is no way to know without knowing the firewall setting.


If you don't have access to the NAT_Firewall this will not work. Presumably that firewall will SNAT, still you need a DNAT for ISAKMP connection.

A solution that probably will work would be to have two Cisco devices and use Cisco Easy VPN, one device acting as a simple client behind the NAT_Firewall.

The cheapest devices would be some 88x, 89x Cisco routers with Security License enabled.

  • Not sure about alternative options but we use ASA 5520 at HQ with 20+ ASA 5505s as Easy VPN clients and it works great through multiple layers of NAT in between. Commented Dec 4, 2013 at 2:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.