Today I was setting up a VPN server and had to figure out what ports and protocols to enable on our Cisco PIX 515E firewall. Here they are:<\/p>\n
PPTP:
\nTo allow PPTP tunnel maintenance traffic, open TCP 1723.
\nTo allow PPTP tunneled data to pass through router, open Protocol ID 47.<\/p>\n
L2TP over IPSec
\nTo allow Internet Key Exchange (IKE), open UDP 500.
\nTo allow IPSec Network Address Translation (NAT-T) open UDP 4500.
\nTo allow L2TP traffic, open UDP 1701.<\/p>\n
Here’s the Cisco access list: (gre=Protocol ID 47, pptp=1723, isakmp=500) (edited to update UDP port 5500 to 4500 as noted in the comments)<\/p>\n","protected":false},"excerpt":{"rendered":" Today I was setting up a VPN server and had to figure out what ports and protocols to enable on our Cisco PIX 515E firewall. Here they are: PPTP: To allow PPTP tunnel maintenance traffic, open TCP 1723. To allow PPTP tunneled data to pass through router, open Protocol ID 47. L2TP over IPSec To … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,4],"tags":[],"class_list":["post-37","post","type-post","status-publish","format-standard","hentry","category-cisco","category-on-the-job"],"_links":{"self":[{"href":"https:\/\/steveneppler.com\/blog\/wp-json\/wp\/v2\/posts\/37","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/steveneppler.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/steveneppler.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/steveneppler.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/steveneppler.com\/blog\/wp-json\/wp\/v2\/comments?post=37"}],"version-history":[{"count":0,"href":"https:\/\/steveneppler.com\/blog\/wp-json\/wp\/v2\/posts\/37\/revisions"}],"wp:attachment":[{"href":"https:\/\/steveneppler.com\/blog\/wp-json\/wp\/v2\/media?parent=37"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/steveneppler.com\/blog\/wp-json\/wp\/v2\/categories?post=37"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/steveneppler.com\/blog\/wp-json\/wp\/v2\/tags?post=37"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
\naccess-list OUTSIDE permit gre any host OUTSIDEIP
\naccess-list OUTSIDE permit tcp any host OUTSIDEIP eq pptp
\naccess-list OUTSIDE permit udp any host OUTSIDEIP eq 1701
\naccess-list OUTSIDE permit udp any host OUTSIDEIP eq 4500
\naccess-list OUTSIDE permit udp any host OUTSIDEIP eq isakmp
\n<\/code><\/p>\n