Access list to permit outbound VPN?

[PETER KNOWLES]

We have the following ACL assigned to WAN port of our Cisco 831:

access-list 111 permit tcp any any established

access-list 111 permit tcp host [*remote private ip snipped*] any eq telnet

access-list 111 permit esp any any

access-list 111 permit ahp any any

access-list 111 permit udp any any eq isakmp

access-list 111 permit udp any any eq 10000

access-list 111 permit gre any any

access-list 111 permit udp any eq isakmp any

access-list 111 permit udp any eq non500-isakmp any

access-list 111 permit udp any eq domain any

access-list 111 permit udp any eq 21068 any

access-list 111 permit tcp any any eq smtp

access-list 111 permit tcp any any eq 3389

access-list 111 permit tcp any any eq 3390

access-list 111 permit tcp any any eq 143

access-list 111 permit tcp any any eq 443

access-list 111 permit tcp any any eq pop3

access-list 111 deny ip any any

Should that allow a host on the LAN to access a remote VPN connection (using Cisco VPN client)? Is anything else needed?

Router is running 12.3(8), already supporting inbound Cisco client connections and one remote LAN-to-LAN VPN.

[scottosan]

i have a few questions:

Are you sure that this is outbound, and not inbound on the WAN interface?

The thing that needs to be identified, is which flavor of IPSEC you are uing in the client. Standard IPSEC and IPSEC over UDP do not work well unless they have a 1 for NAT translation. IPSEC over TCP usually works if you are doing PAT'ing of some sort. If the VPN device on the other end can support IPSEC of TCP (COncentrator or PIX/ASA running 7.x) then set the client to use IPSEC over TCP.

[PETER KNOWLES]

Sorry I was not clear, this is the inbound ACL. The main intent of the post was to make sure nothing in the ACL was blocking a reply from distant end.

Not sure what IPSEC setup the client/destination end is using (I'm coming in at the tailend of this effort, playing mop-up). Hope to identify that on my next call with them.