topic Re: Site to site VPN port 4500 in Network Security

Site to site VPN port 4500

vpersaud001 — Fri, 21 Feb 2020 11:11:29 GMT

Hello,

I have a site to site vpn between two Cisco 2811 routers passing through a PIX 515 on the core side and an ASA5510 on the remote side.

Although I have ports ESP and ISAKMP open the tunnel also requires udp port 4500.

Is that normal? If not any ideas how it can be fixed? Thanks.

Re: Site to site VPN port 4500

cisco24x7 — Mon, 05 Jan 2009 22:16:16 GMT

On the Cisco 2811, do this:

no crypto ipsec nat udp

That will force the VPN tunnel to use ESP

instead of udp/4500

Easy right?

Re: Site to site VPN port 4500

vpersaud001 — Tue, 06 Jan 2009 14:36:17 GMT

Painfully easy. 🙂 I'll use it after hours and post an update.

I guess the full syntax is "no crypto ipsec nat-transparency udp-encapsulation."

Thanks very much.

Re: Site to site VPN port 4500

vpersaud001 — Tue, 13 Jan 2009 20:08:07 GMT

Issue resolved. Thanks again.

Re: Site to site VPN port 4500

tommar — Wed, 08 Jun 2022 08:03:31 GMT

what if i need the opposite. i have some tunnels up on 4500 but one on port 500 down unidirectional. i know it would work on port 4500 but dont know how to push it to use it. any ideas?

Re: Site to site VPN port 4500

Rob Ingram — Wed, 08 Jun 2022 08:18:23 GMT

@tommar if a VPN is established on udp/4500 then a VPN peer is behind NAT. If you have a tunnel established using udp/500, then neither peer is behind NAT.

If you've a problem with one tunnel, then ESP could be blocked - or you've got mismatched phase 1/2 settings.