Add port PIX listens for VPN traffic on

[rimon.vallavanatt]

I want my PIX to listen for traffic on 443 as well as 10000, can this be done?

[ddawson]

The PIX doesn't use TCP or UDP port 10000 for VPN traffic - only the VPN 3000 series supports that feature. The recent PIX software can do NAT Traversal, which uses UDP port 4500, but these ports are not configurable.

TCP port 443 is used by HTTPS and, recently "WebVPN" or SSL VPN clients, but the PIX doesn't support either of these VPN technologies either. If you use PDM to manage the PIX it will use HTTPS, which will use TCP/443, but you can't use that for user data.

In short, no, there is no way to customize the ports the PIX uses to terminate VPN traffic.

[rimon.vallavanatt]

I apologize for my ignorance, not a security guru yet. What port does the PIX use for VPN traffic? Is the feature on track for 7.0 pix sw?

[ddawson]

The PIX (and all other IPSec VPN devices) uses UDP/500 and IP protocol 50 (ESP) for basic VPN traffic. IP protocol 51 (AH) can also be used, but it's much less common. The PIX also supports "NAT Traversal" (or "NAT-T") which is a proposed standard for IPSec through NAT that uses UDP/4500. You cannot change these ports.

Some vendors, including Cisco, also support encapsulation of IPSec traffic in proprietary ways (for example, UDP and TCP 10000 are common options in the Cisco VPN 3000 series, and the Cisco 5000 series supported TCP/80), but NAT-T is quickly becoming the preferred solution.

[rimon.vallavanatt]

We were able to adjust our concentrator so that is would listen for VPN traffic on TCP port443, from a Cisco VPN client not some type of HTTPS but IPSEC. Is the answer simply that PIX cannot and is not on track to provide the same functionality?

[scoclayton]

There are no plans to add WebVPN support to the PIX that I am aware of. However, this does not mean that it could not be added. I would suggest talking with your local Cisco account team concerning this. Sorry I don't have better news on this.

Scott