Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Sysopt command for ipsec

When I use the sysopt connection permit-ipsec command on the pix. Does it open all relevant ports for vpn? Such as esp ah udp 500 etc... Does that mean if I have a vpn concentrator, I don't need to create statics and Acl in the pix for that concentrator?

Thanks.

2 REPLIES
Silver

Re: Sysopt command for ipsec

Hi,

This will open up the necessary ports for VPN tunnel terminating on the PIX, not accross the PIX to a different VPN device in inside. For that, you still need to open up all the ports using static/ACL etc.

Thanks,

Mynul

New Member

Re: Sysopt command for ipsec

Hi there,

To be a little more specific with the operation of the sysopt connection permit-ipsec command...

It does not specifically "open" ports for the VPN traffic. The PIX will listen for VPN connections without this command. The PIX changes how it treats the VPN traffic with the sysopt enabled. With the sysopt connection permit-ipsec command the VPN traffic will be able to by pass the ASA operation of the PIX once the traffic is decrypted. This means that you are not required to have static statements and conduits (or access-lists) to allow the VPN traffic to pass through the PIX. It is really as if the PVN traffic is dropped on the inside interface of the PIX once the clients are connected.

Hope this helps...

Marcus

159
Views
0
Helpful
2
Replies
CreatePlease login to create content