VPN Behind A Firewall

[kendo.igor]

W have a PIX 515E as our firewall. We have a second PIXl that we are planning to setup behind the firewall as a dedicated VPN. What port and protocols do I have to allow through the firewall so that the mobile users can make a VPN connection to the PIX serving as a VPN. I'm going to use IPSec and L2TP.

Thanx.

[gfullage]

You'll need a one-to-one static address translation for the inside PIX. Then allow the following:

IPSec:

UDP port 500

IP protocol 50

IP protocol 51

L2TP:

UDP port 1701

To allow the IP protocl traffic for IPSec through, the access-list looks like the following:

access-list 100 permit 50

access-list 100 permit 51

The PIX will change these numbers to "esp" and "ah" respectively.