What ports should I use to get the VPN RA worked?

Hello

I have a few tunnels l2l. I don't use "vpn sysopt connection permit" command. I prefer to activate the required ports for specific source IP. So they can establish the VPN tunnel with me.

Recently, I have configured remote access vpn. It is work very well... But only when I activate "vpn sysopt connection permit.

Question:

1. what ports need to be activated to get RA VPN work? (without vpn sysopt connection permit)

2. How can I restrict the access of remote when clients they connected to my private network?

Thank you

Leo

Hi Leo,

When you are not using 'connection sysopt... '. ", you must explicitly permit udp 500 and udp 4500, traffic esp on the outdoor access list.

Let's say that public intf outside ip address is x.x.x.x and pool customer, we use y.y.y.0 and you want to allow 'only' traffic for port 80 through the tunnel.

In the ACL on the outside, you need the following instructions:

access-list 101 permit udp any host x.x.x.x eq 500

access-list 101 permit udp any host x.x.x.x eq 4500

access-list 101 permit esp any host x.x.x.x

access-list 101 permit tcp y.y.y.0 255.255.255.0 eq 80

access-list 101 deny ip 255.255.255.0 y.y.y.0

* Please indicate the post if it helps.

-Kanishka

Tags: Cisco Security

Similar Questions

Maybe you are looking for