Solved: IPSec over TCP on PIX 501E

escisco · ‎06-30-2004

Hi,

Is there any way i can configure IPSec over TCP as a default configuration in PIX Firewall. I am running 6.3

gfullage · ‎06-30-2004

The PIX doesn't support IPsec over TCP. It does support NAT-T, which is IPSec over UDP/4500, which the Cisco VPN client also supports. Just add the following command onto the PIX:

isakmp nat-traversal

The PIX and VPN client will auto-negotiate IPSec encapsulation if necessary. See http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/gl.htm#wp1027312 for details.

View solution in original post

gfullage · ‎06-30-2004

The PIX doesn't support IPsec over TCP. It does support NAT-T, which is IPSec over UDP/4500, which the Cisco VPN client also supports. Just add the following command onto the PIX:

isakmp nat-traversal

The PIX and VPN client will auto-negotiate IPSec encapsulation if necessary. See http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/gl.htm#wp1027312 for details.