RE: Ports for Cisco VPN 3000 Series

Hi Mark, 

Client less VPN, does he mean SSL VPN clients. 

ESP : IP Protocol 50. Is it like TCP port 50. Could you explain more
about this.

-harjith 


-----Original Message-----
From: Mark Lewis [mailto:mark@mjlnet.com] 
Sent: Wednesday, September 14, 2005 2:00 AM
To: Doug Fox
Cc: firewalls@securityfocus.com
Subject: Re: Ports for Cisco VPN 3000 Series


Ports relevant for IPsec VPNs:

ISAKMP traffic- UDP port 500.
ESP traffic- IP protocol 50.
AH traffic- IP protocol 51. Note that the Cisco VPN 3000 concentrator
does not support AH.

IPsec NAT traversal (depending on how you configure it):

Industry standard NAT-T uses UDP port 4500.
IPsec over a user defined TCP port (10000, by default, on the Cisco VPN
3000 concentrator). IPsec over a user defined UDP port (10000, by
default, on the Cisco VPN 3000 concentrator).


SSL clientless VPNs:

TCP port 443 (HTTPS).


Hope that helps,

Mark




---- Original message ----
> Date: Thu, 8 Sep 2005 20:28:45 -0400
> From: "Doug Fox" <dfox168@hotmail.com>
> Subject: Ports for Cisco VPN 3000 Series  
> To: <firewalls@securityfocus.com>
>
>   Which ports should I open on the firewall allowing
>   "Site to Site" and "Client to Site" IP Sec VPNs as
>   well as Clientless VPNs?
>    
>   By the way, can this Cisco VPN be placed in the DMZ
>   or behind the firewall on the internal network?
>    
>   Any info/pointers are much appreciated.
>    
>   Thanks,
>