06-11-2003 10:21 AM - edited 02-21-2020 12:36 PM
When I use the sysopt connection permit-ipsec command on the pix. Does it open all relevant ports for vpn? Such as esp ah udp 500 etc... Does that mean if I have a vpn concentrator, I don't need to create statics and Acl in the pix for that concentrator?
Thanks.
06-11-2003 10:32 AM
Hi,
This will open up the necessary ports for VPN tunnel terminating on the PIX, not accross the PIX to a different VPN device in inside. For that, you still need to open up all the ports using static/ACL etc.
Thanks,
Mynul
06-11-2003 01:17 PM
Hi there,
To be a little more specific with the operation of the sysopt connection permit-ipsec command...
It does not specifically "open" ports for the VPN traffic. The PIX will listen for VPN connections without this command. The PIX changes how it treats the VPN traffic with the sysopt enabled. With the sysopt connection permit-ipsec command the VPN traffic will be able to by pass the ASA operation of the PIX once the traffic is decrypted. This means that you are not required to have static statements and conduits (or access-lists) to allow the VPN traffic to pass through the PIX. It is really as if the PVN traffic is dropped on the inside interface of the PIX once the clients are connected.
Hope this helps...
Marcus
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide