topic Re: IPSec VPN Ports/Protocol in Network Security

IPSec VPN Ports/Protocol

Muhammad Zubair — Mon, 11 Mar 2019 14:18:58 GMT

I want to fine tune our firewall, for that I need to allow IPSec VPN traffic in firewall. Can anyone tell me the exact IPSec Ports & Protocols? Our VPN device resides behind firewall and using IPSec over UDP.

We are using Cisco ASA 5500 series as a VPN server.

Re: IPSec VPN Ports/Protocol

Fernando_Meza — Fri, 28 Nov 2008 03:12:02 GMT

Hi,

For that you might need to allow UDP 500 also you might also need to allow ESP (protocol 50)

Assuming your VPN head end device uses a routable (public) IP address then you only need to allow the above ports, otherwise you will have to use static NAT.

what is your scenario ?

Re: IPSec VPN Ports/Protocol

ajagadee — Fri, 28 Nov 2008 05:07:41 GMT

Hi,

ISAKMP - UDP 500

ESP - Protocol 50

ISAKMP NAT-Traversal - UDP 4500 (NAT-T)

IPSEC Over UDP - UDP 10000 (Default)

IPSEC Over TCP - TCP 10000 (Default)

Regards,

Arul

*Pls rate if it helps*

Re: IPSec VPN Ports/Protocol

jzhan — Sun, 07 Jun 2009 15:24:10 GMT

Hi,

I have been search for this for a quite long time, but never got a firm answer.

Cisco VPN client on-line help says: IPSec over UDP - this port is negotiated and can not be changed - but never able to find any mention of how it is negotiated.

Looking at Sniffer packets - beside UDP 500, Sometimes UPD 62515, and other time UDP 62514 was used. UDP 10000 was never used.

Thanks