RV34x: L2TP/IPsec fails when router is behind NAT device

Available Languages

Download Options

  • PDF     (5.6 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (83.7 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (65.4 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:September 17, 2020
Document ID:1600365857801263

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Summary

When the RV34x is behind a Network Address Translation (NAT) device, Layer 2 Tunneling Protocol (L2TP)/Internet Protocol Security (IPsec) fails. This document has been developed to highlight this issue and to define the steps that needs to be followed to resolve it.

Version (s) Affected

All

Date Identified

March 16, 2020

Date Resolved

N/A

Products Affected

RV34x Series

Bug ID

CSCvt43786

Issue Description

When the RV34x router is behind a NAT device, L2TP/IPSec fails. The logs may indicate that the router receives a ‘Delete’ notification from the client during Phase 2 negotiation. IPsec clients like Shrew Soft work fine. This is due to a Microsoft Windows issue. This document defines the workaround to allow NAT on both sides.

Workaround

This issue has been known and documented. For more details, refer to the article on Connecting L2TP/ IPSec VPN Server Behind a NAT, Error Code 809.

For additional information, check out the article on How to configure an L2TP/IPsec server behind a NAT-T device in Windows Vista and in Windows Server 2008.

If you do not wish to modify the registry, use the following options:

  • You can configure a public IP address on RV34x WAN.
  • Use IPSec-only VPN client.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco