allowing IP port 50 (ESP)?

[cahelmster]

I need to allow IP port 50 for ESP to my PIX-515 for a VPN connection. I'm familiar with adding IP hosts but not IP ports...only TCP or UDP ports. What access list command should I use?



----------------
Thanks!
cahelmster

 

[lgarner]

ESP is a protocol. You'll also want to allow 51 (AH) and TCP port 500.

"sysopt connection permit-ipsec" takes care of it for you.

 

[cahelmster]

ok...sounds easy enough...

This is a separate VPN device behind my firewall that will be configured to establish a VPN connection over the Internet to another site. So the sysopt command will take care of everything and is also for outbound only?

Will I also need NAT statements if the device is using a new public IP?

----------------
Thanks!
cahelmster

 

[gconnect]

This is a separate VPN device behind my firewall that will be configured to establish a VPN connection over the Internet to another site. So the sysopt command will take care of everything and is also for outbound only?"

No not really, ESP is not stateful per-say. You will need to add permit statements to the outside PIX interface.
If I am not mistaken, 'sysopt connection permit-ipsec' just allows all decrypted traffic in. Since the VPN connection is not terminating on the firewall itself you will need to allow the needed VPN Tunnel traffic to pass-through the PIX.


access-list ACL_Outside permit udp host $REMOTE_ENDPOINT_IP host $LOCAL_ENDPOINT_IP eq 500
access-list ACL_Outside permit esp host $REMOTE_ENDPOINT_IP host $LOCAL_ENDPOINT_IP
access-list ACL_Outside permit udp host $REMOTE_ENDPOINT_IP host $LOCAL_ENDPOINT_IP eq 4500

access-group ACL_Outside in interface outside

You may need udp/4500 for NAT-Transparency (ESP wrapped in UDP) since you have a NAT device in between.


"Will I also need NAT statements if the device is using a new public IP?"

Yup
static (inside, outside) $New_Public_IP $Inside_IP

 

[cahelmster]

cool...thanks

are there ports to ESP to narrow down the access-list statement? I'm not used to really anything but IP...

----------------
Thanks!
cahelmster