allow server initiated tunnels through FW

[nygenxny123]

Our server team is  looknig to Encapsulate domain Controller (DC-to-DC) traffic inside IPSec.   Following is the list of ports that would be needed if we go with IPSec route

DNS - 53/tcp, 53/udp

PPTP establishment - 1723/tcp

GRE, generic routing encapsulation - IP protocol 47

Kerberos - 88/tcp, 88/udp

IKE, Internet Key Exchange - 500/udp

IPSec ESP, encapsulated security payload - IP protocol 50

IPSec AH, authenticated header - IP protocol 51

My questions is IP protocol 51 and 57

all the other ports have been been opened...what would i need to enable on the FW to allow IPsec AH and GRE?

[Jitendra Siyag]

the lines would be

access-list test extended permit gre source destination

access-list test extended permit esp source destination

access-list test extended permit ah source destination

and allow udp 500 and 4500 if NAT is there

hope this helps