GRE tunnel over Firewall

[anton.caldeir]

Hi Folks,

We  build a IPSec  tunnel from a router remote site to ours central site router. We have a corporate Firewall (ASA) protecting our  central site...

To acomplis this task we made on ASA a one-to-one Static NAT and a inbound access-list permiting the remote site ip  on port´s UDP/4500 and UDP /500…

Regarding the static NAT on the ASA, it is normal practice open port´s inbound so the IPsec tunnel could be established? it is considered secure? I have search for a designed guide or best practices when we need to build a IPsec tunnel or any other  type of tunnel over ASA, but i did not find anything....

Can anyone help….

Best Regard´s

António

[Rob Ingram · Accepted solution]

Hi @anton.caldeir there probably won't be a design guide for your specific design, establishing a VPN tunnel with a router behind an ASA. As long as the IPSec algorithms you use are strong enough and the authentication method is not weak it should be secure.

[anton.caldeir]

Thanks a lot for your help Rob.

And the fact that we are opening inbound port´s for the remote site IP in
ASA:

access-list outside_access_in extended permit udp "Remote_Site_IP"
"central_site_IP" eq 4500
access-list outside_access_in extended permit
udp "Remote_Site_IP" "central_site_IP" eq isakmp

this could be a potential security threat to our organization? or could be
exploited by untrusted people ?

Best Regards
António

[Rob Ingram · Accepted solution]

@anton.caldeir you are being very specific in your source in the ACL, so that would reduce the chances of being a threat.