ipsec vpn ports?

[blackswans]

Hi,

I will make a site to site vpn betweeen two asa firewalls. But I have a adsl modem in front of the firewall so I need to make nat for these ports which are used by vpn. so what are these ports ? which ports should I make nat for vpn ?

thanks

[Jennifer Halim]

For IPSec VPN, the following ports are to be used:

Phase 1: UDP/500

Phase 2: UDP/4500

You would also need to enable NAT-T on your ASA (command: crypto isakmp nat-traversal 20):

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/c5.html#wp2191067

That would encapsulate ESP (phase 2) to UDP/4500 so it can be NATed.

[andrew.prince]

It also advisable to open protocol 50 - ESP aswell.

HTH>

[Kent Heide]

Most likely not possible on an ASDL modem and since he is doing NAT the solution would be as stated above to use NAT-T. Therefore pushing phase 2 up to udp/4500.