EoIP mobility tunnel and FW rules

[pallaruelo]

Hello,

I have a question, which equipment initiates the data path EoIP tunnel between a corporate controller and a guest controller located in a DMZ ?

Main Controller (Trusted Zone) <----->Firewall ASA5505<----->Guest Controller (Untrusted Zone)

Thank you in advance for your answer.

Franck.

[Rasika Nayanajith]

I would open EoIP (IP protocol 97) and UDP 16666 in both directions.

HTH

Rasika

[pallaruelo]

Hello Rasika,

That's I noticed too on the ASA5505.

Many thanks,

Franck.

[Stephen Rodriguez · Accepted solution]

I agree with Rasika. Allow either side to send the traffic.

but IIRC, the lowest MAC address, per pair, is the one that initiates the EOIP tunnel.

HTH,

Steve