Specifications

Altitude 3500 Series Access Point Product Reference Guide
586
VPN tunnels are negotiated on an “as-needed” basis. If you have not sent any traffic between the
two subnets, the tunnel will not get established. Once a packet is sent between the two subnets, the
VPN tunnel setup occurs.
● Question 10: I still can't get my tunnel to work after attempting to initiate traffic between the two
subnets. What now?
Try the following troubleshooting tips:
● Verify you can ping each of the remote Gateway IP addresses from clients on either side. Failed
pings can indicate general network connection problems.
● Pinging the internal gateway address of the remote subnet should run the ping through the
tunnel as well. Allowing you to test, even if there are no clients on the remote end.
● Try re-setting the shared secret password on the access point.
● Question 11: My tunnel works fine when I use the LAN-WAN Access page to configure my
firewall. Now that I use Advanced LAN Access, my VPN stops working. What am I doing wrong?
VPN requires certain packets to be passed through the firewall. Subnet Access automatically inserts
these rules for you when you do VPN. Advanced Subnet Access requires these rules to be in effect
for each tunnel.
● An 'allow' inbound rule:
● An 'allow' outbound rule:
● For IKE, an 'allow' inbound rule:
These three rules should be configured above all other rules (default or user defined). When
Advanced LAN Access is used, certain inbound/outbound rules need to be configured to control
incoming/outgoing packet flow for IPSec to work properly (with Advanced LAN Access). These
rules should be configured first before other rules are configured.
Scr <Remote Subnet IP range>
Dst <Local Subnet IP range>
Transport ANY
Scr port 1:65535
Dst port 1:65535
Rev NAT None
Scr <Local Subnet IP range>
Dst <Remote Subnet IP range>
Transport ANY
Scr port 1:65535
Dst port 1:65535
NAT None
Scr <Remote Subnet IP range>
Dst <WAN IP address>
Transport UDP
Scr port 1:65535
Dst port 500
Rev NAT None