How to change port number of ISAKMP?

[SupIceCat]

The default port number for ISAKMP is 500, how do I change it?

The platform is Cisco 1841 with IOS v12.4

[Jennifer Halim · Accepted solution]

You won't be able to change only phase 1 (ISAKMP) port as the default  is UDP/500. What is the reason to change it to other ports?

You  can however encapsulate phase 2 (IPSEC) ESP packet in either UDP or TCP  protocols to avoid the issue with ESP packet going through NAT device.  This is called IPSec NAT Transparency. Phase 2 is by default  encapsulated to UDP/4500 if the ESP packet passes through NAT device, or  you can also encapsulate it to TCP or UDP on other ports.

If you use TCP as protocol for phase 2, then phase 1 will uses TCP as well on the same port configured.

If you encapsulate with UDP for phase 2, then phase 1 will continue to use UDP/500.

Hope that makes sense.

[SupIceCat]

Thanks for your answer. The router is under a special network environment that must use ports other than 500.

Could you please give me some commands example of this port-changing configuration? I do not know where to start with.

[Jennifer Halim]

Just double check, and I couldn't seem to find any reference to be able to change the port for IOS router.

You can definitely change the IPSec encapsulation port for ASA firewall, but I can't seem to find anything about changing ports on IOS router.

You might want to open a TAC case to double confirm.