Possible to 'tunnel' through this setup?

[JPS]

Here is the deal - just started work at new co that issued its field force IBM T30s to use. These have build in ethernet and wireless access as well as dialup. To contact the home office, we are supposed to use dial-up with a secure connection provided by Check Point's VPN-1 SecureClient. That works fine after I porvide the appropriate credentials. However, it takes forever over dial-up, and I mean HOURS, due to the updates and databases corporate pushes out to the field force on a daily basis.

Now, here is my question. At home, which is also my 'office' I have cable broadband and a wireless setup. The cable comes into the modem and is patched into a D-Link 614+ broadband wireless router. From them, the connection is connected via wired-etehrnet to a workstation (my primary personal PC) and via wireless to up to 3 different laptops.

I took my new T30 and tried to connect up to my existing broadband connection to speed up the communication sessions with the corporate home office. In short, if it connects through the DI-614+ router the connection fails when I try to connect to the VPN. I have tried putting the laptop in the DMZ, opening all of the TCP/UDP ports, etc, and nothing works. However, if I pull the cable connection so it connects directly to the T30 and not the DI-614+ router then everything works fine and I can connect to the VPN without any problem.

Now, is there a way that I can tunnel through the DI-614+ into my corporate VPN that I am missing? Or, would my simplest recourse be to insert a hub/switch into the network prior to the DI-614+ router so that the connection is spilt to the laptop and the router separately? or, is there another soultion altogether?

And no, I cannot call corporate IT for help b/c high-speed connectivity will not be implemented for the field force until sometime next year. Right now, the policy is "if it works, great - if it doesn't then you must dial in".

 

[mixmastertarzan]

Step Number one would be sure to have the latest firmware for your D-link up to date. The next thing would be to make sure the IPSEC and VPN passthrough is enabled. Also make sure that the ipsec service on your computers connecting is set to automatic and is running.

 

[JPS]

Latest firmware is in. Pass throughs are enabled as well. Services are runnig too.

I just tried again for the hell of it and a connection is made, but the corporate intranet sites are not available in MSIE. Rather, I just get a perpetual "opening page..." in the status bar in the lower left corner.

 

[JPS]

Anyone else?

 

[bgroff]

Yes. Depending upon which version of SecuRemote you're using, there's an option for UDP encapsulation. Turn this on, and watch the magic happen... This uses a Checkpoint proprietary method of encapsulating the IPSec packets into a UDP datagram. Assuming your company was wise enough to enable this feature, you'll be good to go.

 

[JPS]

bump..

 

[chsh1ca]

At risk of utterly stating the obvious, why don't you just ask the guys in your new company's tech department if it's possible and/or within company policy. Attempting to circumnavigate corporate protection methods like that might be seen as crossing the line, even if you have been given the proper rights. You obviously don't know how their internal lan is setup, so I would consult the tech people and let them do the dirty work for you.

 

[Fallen Kell]

nods with chsh1ca. We didn't even allow non-modem connections from off site until a month ago, mainly because we had to dial into a specific system which acted as the ISP (i.e. you don't dial up to your normal ISP). This was done for security reasons. Yours might also be a security measure as well, but I doubt it. Still it is best to call your local tech support, as they might have issue with this being done (or just would like to know that you are doing it).

 

[buleyb]

Agreed....if your IT dept won't help you, get your boss involved...its impacting your time.

 

[mboy]

Yup 1st step is asking if they will allow you to do that in the 1st place.

 

[JPS]

I appreciate everyone's concern regarding asking IT first. Here is the deal: IT will support field force users that are on dial-up and managers that are on high speed. I am not a manager so I am relegated to dial-up officially. HOWEVER, I have been told by IT that if I plug my broadband connection into my laptop and it works - that is fine. They will not support it if I have problems, but neither will they ban me from using it. FWIW, they do know I am on braodband and do not care, they just will not help with my situation and have told me to figure it out myself so that is what I am doing.

WHat I have done now is put a switch between my cable router and cable modem. From this switch I have a connection directly to my corporate laptop and all works fine and a connection to my existing homenetwork which works fine. Problem solved for the most part....