RE: VPN protocols

["John Forristel (SunGard-Chico)" <John.Forristel () sungardbi-tech com>]

GRE and ESP are protocols, not ports, so they are transported through on
configured ports.  In Cisco, you permit gre and esp through for the VPN
traffic.

In a conduit statement:

conduit permit esp any any
conduit permit esp any any

notice that there is no tcp, udp, or ip in the permit statement.

I've noticed that, on some firewalls, it is buried deep in the bowels of
the config, and has timeouts set to drop the protocol after so many
minutes.