In the Cisco VPN Client User Guide for Linux, Solaris, and Mac OS X it gives an example on page 2-3 which uses ipchains and recommends removing two lines from your /etc/sysconfig/ipchains config file. This is bad advice. Do not remove the lines which filter udp/0:1023 and udp/2049 as this would make the linux box less secure.
The Cisco 3000 VPN Concentrator vpnclient for Linux requires communication using IKE, ESP, and AH, and can also use UDP on a user definable port when necessary.
To allow IKE, open udp/500
for ESP open protocol 50
and for AH open protocol 51
In the newer linux distributions which use the 2.4 kernel the default firewall is iptables.
On a default RH8 system using the default Medium or High firewall settings during install or later running the lokkit program, all I needed to do to allow the Cisco vpnclient to work was to open udp on port 500. Evidently ESP and AH protocols are not blocked.
The following line must be added in /etc/sysconfig/iptables above the line which rejects udp on low ports 0-1023 and 2049 (NFS):
-A RH-Lokkit-0-50-INPUT -p udp -m udp -s 0/0 --sport 500 -d 0/0 --dport 500 -i eth0 -j ACCEPT
The filter can be made even more secure by specifying the Cisco 3000 public address in the -s (source) parameter.
