Remote access behind NAT router

Question

I'm trying to set up a remote VPN connection from a windows 10 machine and an iphone to UTM 9, which is behind a NAT router. 
 I've tried L2TP over IPsec, IPsec, cisco VPN client... and failed every time. 
 Does anyone have a how-to for this scenario?

Phil Reah · Accepted Answer

Yes - saw that. 
 I needed to put the public there to get ipsec site-to-site working when I was playing with that. 
 (Site-to-site works, just not remote access).

BAlfson · Answer

Here are the key lines: 016:11:22-20:36:20 utm pluto[14342]: "L_for user"[2] :64916 #1: sent MR3, ISAKMP SA established 2016:11:22-20:36:25 utm pluto[14342]: "L_for user"[2] :64916 #1: cannot respond to IPsec SA request because no connection is known for /32===192.168.1.2:4500[]:17/1701...:64916[10.0.196.138]:17/%any==={10.0.196.138/32} We see that the connection fails right after the ISAKMP SA is established. There are three possibilities: The PSK isn't correct. (maybe 1.b) There was already a "Respond Only" IPsec Remote Gateway defined in Site-to-Site and you didn't select 'Enable probing of preshared keys' on the 'Advanced' tab of 'IPsec'. One would need to re-enter the L2TP PSK after selecting that. The UTM is behind a NAT'ing router - it doesn't have a public IP on the External interface. This "breaks" IPsec. I rarely read the title of a thread. Had I done so, I would have saved us both a lot of effort. [;)] The best would be to put your modem/router in bridge mode so that you can get a public IP on the External interface - that pays off in several ways. My preference in any case would be to use the SSL VPN which can work either way. The free OpenVPN apps for iPhone and Android are my preference. The UTM Client works great on Windows platforms. Cheers - Bob

Phil Reah · Answer

Ah... 
 The PSK's definitely right... and there is indeed a gateway set up in site-to-site (so probing is already enabled)... so my vote goes with 3! 
 (As my old maths teacher used to say "The answer's in the question" :-) ) 
 I'll switch to trying SSL. 
 Thanks for your speedy response.

BAlfson · Answer

You're welcome, Phil. Wait a minute, would you try something? Sophos recently added what I believe may be the missing "leftid" for StrongSWAN. In 'Preshared Key Settings' on the 'Advanced' tab, put the Public IP of the modem in 'VPN ID' - does L2TP/IPsec work then? 
 Cheers - Bob