Which protocols and ports must a firewall allow for an IPsec VPN to come up?
Show the answer
Say this first
UDP 500 for IKE, and ESP (IP protocol 50) for the data. When NAT traversal is in use, both IKE and ESP move to UDP 4500, so allow that too. AH (IP protocol 51) only if someone really uses AH. If any device in the path does NAT, plan on UDP 500 and UDP 4500 only.
Go deeper
| Traffic | Protocol and port | When |
|---|---|---|
| IKEv1 and IKEv2 | UDP 500 | always, to start |
| IKE and ESP with NAT-T | UDP 4500 | NAT detected on the path, or NAT-T forced |
| ESP | IP protocol 50 | no NAT on the path |
| AH | IP protocol 51 | rare |
On an IOS router with an outside ACL
ip access-list extended OUTSIDE-IN
permit udp host 203.0.113.2 host 198.51.100.1 eq isakmp
permit udp host 203.0.113.2 host 198.51.100.1 eq non500-isakmp
permit esp host 203.0.113.2 host 198.51.100.1isakmp is UDP 500 and non500-isakmp is UDP 4500.
GRE inside IPsec
When GRE is protected by IPsec, the firewall never sees protocol 47; it only sees ESP or UDP 4500.
They will ask next
The peers talk on UDP 4500 although you configured no NAT. Why?
Something in the path does NAT: a provider CGNAT, or cloud 1:1 NAT such as a public IP in front of a cloud VM. NAT detection in IKE found that the addresses changed and both sides switched to UDP 4500. That is normal and works, as long as UDP 4500 is allowed.
Traps
- Saying "ESP uses port 50". ESP has no ports; it is IP protocol 50.
How did you do?Book 8.5 Example Systems