Lock down ports used for IPSec over GRE on Cisco ASA

[johnlloyd_13]

hi all,

i would like to 'lock down' crypto ACL used for S2S/L2L IPSec from IP to ISAKMP and ESP ports only.

could anyone confirm if thinking below is correct? no need for GRE port 47?

object service UDP_500
 service udp source eq 500 destination eq 500

object service UDP_4500
 service udp source eq 4500 destination eq 4500

object service ESP_50
 service esp

object-group service VPN_PORTS
 service-object object UDP_500
 service-object object UDP_4500
 service-object object ESP_50

no access-list S2S_ACL extended permit ip host 1.1.1.1 host 2.2.2.2
access-list S2S_ACL extended permit object-group VPN_PORTS host 1.1.1.1 host 2.2.2.2

[Spooster IT Services]

Hi johnlloyd_13,

You only need to allow UDP port 500, 4500 and ESP protocol. GRE is encapsulated and encrypted by ESP so need to open that. 

[johnlloyd_13]

hi,

so my above config is confirmed acceptable?

[Spooster IT Services]

Yes, It is correct.

[johnlloyd_13]

hi,

thanks! one last thing, i configure the same ACL to 'mirror' the crypto ACL on the other ASA correct?

meaning, change the ACE from IP to the grouped VPN ports.

[Spooster IT Services · Accepted solution]

Yes. 

GRE tunnels are not supported on ASA. is this ACL for routers behind the ASA's?

[johnlloyd_13]

yes, GRE tunnels are terminated on routers behind ASA.

[Spooster IT Services]

That's Great. Go ahead with the above configuration.

[Karsten Iwen]

Well, although the ACL can work, it doesn't make much sense. We need to look at two scenarios:

1) No NAT between the IPsec-peers. You need UDP(500,500) and ESP. That is covered.

2) If there is NAT, the connection is started with UDP(500,500), but the source-port can get changed to something different. After detecting NAT, the initiator switches to UDP(4500,4500) and again the source can be changed to something else. Here, no ESP is seen by the ACL as everything is encapsulated in UDP.

[johnlloyd_13]

hi karsten,

thanks for diving in! my scenario is depicted on your item 1.

i've got GRE tunnels terminated on a router that's behind the ASA that would trigger the 'interesting' traffic (crypto ACL).