VPN - Authentication flow and ports used

[8kpan]

Our company plans to implement a new IPSec VPN solution. Details are as follows:

Equipment involved:

VPN 3030 concentrator, Cisco ACS server, 2 ACE servers, 2 Firewalls

In my understanding, the authentication flow of a VPN client will look like:

VPN client -> |FW| -> VPN 3030 -> ACS server -> ACE server

Is my understanding correct?

In each of the interaction, do you know which ports will going to be used?

Please kindly help.

[aacole]

One solution would use:

ISAKMP using UDP 500, ESP using IP Protocol 50. Also enable NAT-T using UDP 4500 if the VPN tunnel goes over a PAT device.

For the ACS, you could use RADIUS for authentication in which case UDP 1812 and if you want accounting then UDP 1813, this should suffice.