What ports to allow through for VPN access to Checkpoint NG

[rstockton]

I will be implementing a client-to-site VPN to allow road warriors to tunnel in from the Internet. Our firewall sits behind a router running ACLs. My question to you is what ports do I need to allow through the external router to the Checkpoint NG firewall/VPN module?

The clients will be running Checkpoint's SecureClient.

Thanks in advance

-r

 

[SIGSEGV]

If you are using normal IPSec without AH, you'll need to open up UDP port 500 for IKE, and protocol 50 (_protocol_, not port) for IPSec ESP. If you are using AH, you will also need protocol 51.

If you are using UDP wrapped IPSec, you'll just need UDP/500 and whatever UDP port you encapsulate in.

 

[rstockton]

Thanks,

I've also been advised to pass:

tcp 18231
udp 18233
tcp 90
udp 2746