topic Re: IPSEC passthrough on ASA5505 in Network Security

IPSEC passthrough on ASA5505

lifecareit — Mon, 11 Mar 2019 11:04:25 GMT

Trying to set up ASA 5505 to allow IPSEC passthru for AT&T Global network Client VPN.

Re: IPSEC passthrough on ASA5505

jeremyault — Thu, 30 Aug 2007 15:16:56 GMT

Create an ACL to allow the traffic to pass? Assuming you're using esp and ike.

access-list 111 permit esp

access-list 111 permit udp eq isakmp

access-group 111 in interface outside

That will let it pass through un-natted. If you need to nat then you'll need to create a static nat.

Re: IPSEC passthrough on ASA5505

srue — Thu, 30 Aug 2007 15:41:38 GMT

http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/inspect.html#wp1522169

Re: IPSEC passthrough on ASA5505

lifecareit — Thu, 30 Aug 2007 19:49:34 GMT

Did that part already...looks like a static nat is in order.

Re: IPSEC passthrough on ASA5505

JORGE RODRIGUEZ — Thu, 30 Aug 2007 20:20:09 GMT

These are the IPsec vpn ports that need to be allowed through.

udp 500

udp 4500

protocol 50 esp

Re: IPSEC passthrough on ASA5505

jeremyault — Sun, 02 Sep 2007 15:56:31 GMT

Oh yeah, I just remembered, if the clients are using NAT traversal, you'll need to permit the UDP port being used - most often UDP 10000 but could be whatever port NAT-T is set to.