RE: VPN protocols

GRE and ESP are IP Protocols.

On nearly all modern firewalls you specify the ip transport [esp, ah, gre, 
other] between the two networks. Conduits for the msot part are being phased 
out so on an IOS device or PIX the line would be something like this when 
configured correctly

access-list ingress permit esp host <remote-host-ip> host <local-ip>
access-list ingress permit udp host <remote-host-ip> host <local-ip> eq 500

this will permit most IPSEC vpns to work between two permitted termination 
points. permitting all hosts to transport vpn traffic is not the best design. 
Doing so helps pentesters and blackhat gain more information on your device 
configuration than they need.

-keith

-----Original Message-----
From: John Forristel (SunGard-Chico)
[mailto:John.Forristel@sungardbi-tech.com]
Sent: Wednesday, December 22, 2004 12:04 PM
To: Dan Tesch; Pen Test
Subject: RE: VPN protocols


GRE and ESP are protocols, not ports, so they are transported through on
configured ports.  In Cisco, you permit gre and esp through for the VPN
traffic.

In a conduit statement:

conduit permit esp any any
conduit permit esp any any

notice that there is no tcp, udp, or ip in the permit statement.

I've noticed that, on some firewalls, it is buried deep in the bowels of
the config, and has timeouts set to drop the protocol after so many
minutes.