From: Keith Pachulski (keithp@corp.ptd.net)
Date: Wed Dec 22 2004 - 14:21:56 EST
GRE and ESP are IP Protocols.
On nearly all modern firewalls you specify the ip transport [esp, ah, gre, other] between the two networks. Conduits for the msot part are being phased out so on an IOS device or PIX the line would be something like this when configured correctly
access-list ingress permit esp host <remote-host-ip> host <local-ip>
access-list ingress permit udp host <remote-host-ip> host <local-ip> eq 500
this will permit most IPSEC vpns to work between two permitted termination points. permitting all hosts to transport vpn traffic is not the best design. Doing so helps pentesters and blackhat gain more information on your device configuration than they need.
-keith
-----Original Message-----
From: John Forristel (SunGard-Chico)
[mailto:John.Forristel@sungardbi-tech.com]
Sent: Wednesday, December 22, 2004 12:04 PM
To: Dan Tesch; Pen Test
Subject: RE: VPN protocols
GRE and ESP are protocols, not ports, so they are transported through on
configured ports. In Cisco, you permit gre and esp through for the VPN
traffic.
In a conduit statement:
conduit permit esp any any
conduit permit esp any any
notice that there is no tcp, udp, or ip in the permit statement.
I've noticed that, on some firewalls, it is buried deep in the bowels of
the config, and has timeouts set to drop the protocol after so many
minutes.
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:54:11 EDT