VPN and Port Forwarding of UDP 4500

[douiriothmane]

Hi Guys,

I have an ASA 5555 where I had port forwarding configured, I am redirecting UDP 4500 from outside to an internal server. In fact, I have some access points on different remote sites that need to communicate with their controller using UDP/4500 (the controller is in my LAN)

I tried to configure a site to site VPN with another remote ASA but it did not work. I have an error saying that port 4500 can not be opened on the outside interface.

I'm suspecting that this is caused by the port forwarding rule already in place. I would like to know if there is any way to make the site to site VPN while still keeping the port forwaring rule for UDP/4500.

Thank you in advance

Regards,

[bhavsha2]

Hello,

I believe there is a NAT traversal is happening for the Site to site vpn where the external interface on either would be getting translated. 

I suspect the port forwarding you would be doing on the external interface ip address to which the NAT traversal would be mapping the ip address to port 4500 UDP.

2 things could be done

1) Change the port forwarding to a different pool ip address rather than the interface ip. In this case I am assuming that you are doing nat with the Interface ip

2) Configure the port forwarding such that the traffic is initiated on 4510 and then map to 4500 . 

Currently you would be having the port forwarding rule to be initiated on port 4500 and then the ip address would be getting translated.

Regards,

Bhavik 

[Karsten Iwen]

completely untested, but if you disable NAT-traversal, then perhaps the ASA doesn't need the port udp/4500 any more:

no crypto isakmp nat-traversal

But then there are no clients any more allowed to behind a NAT. You don't have any spare external IP for the forwarding to your internal server?

[bhavsha2]

Hello, I am not asking to disable the NAT because if that is done then the identities has to be changed which may not be feasible If the ip address which is getting natted for the Wireless controller is the same to which the ip address is Natted for the vpn traffic, then the only feasible thing would be to initiate the traffic on port say 4510/UDP for the Wireless Controller and then map it to 4500 .

This could have also been possible if ASA supported vrf where we could keep the vpn or the Internet traffic interface in a specific vrf

Regards,

Bhavik Shah