Ports needed for VPN Client to PIX VPN Device

[unionbancorpit]

We have an PIX 515 and a 2650 router (outside the PIX). We have a few users who VPN to the PIX from home using the Cisco VPN client. We are trying to tighten the ACL on the outside router so we need to allow the necessary traffic to allow the users to VPN. I am allowing port 47 and 1723 to the firewall's outside IP address but I am unable to connect. Thanks.

[a.awan]

I think you meant protocol 47 but this is GRE while port 1723 is PPTP. I personally think you must be using IPSec and for that to work properly you need to open the following to your firewall:

permit esp any host

permit udp any host eq isakmp

permit udp any host eq non500-isakmp

If this does not work include a line "deny ip any any log" at the end of your access-list and then see what is being denied. It will help you fix the issue.