RE: VPN protocols

["Keith Pachulski" <keithp () corp ptd net>]

GRE and ESP are IP Protocols.

On nearly all modern firewalls you specify the ip transport [esp, ah, gre, other] between the two networks. Conduits 
for the msot part are being phased out so on an IOS device or PIX the line would be something like this when configured 
correctly

access-list ingress permit esp host <remote-host-ip> host <local-ip>
access-list ingress permit udp host <remote-host-ip> host <local-ip> eq 500

this will permit most IPSEC vpns to work between two permitted termination points. permitting all hosts to transport 
vpn traffic is not the best design. Doing so helps pentesters and blackhat gain more information on your device 
configuration than they need.

-keith

-----Original Message-----
From: John Forristel (SunGard-Chico)
[mailto:John.Forristel () sungardbi-tech com]
Sent: Wednesday, December 22, 2004 12:04 PM
To: Dan Tesch; Pen Test
Subject: RE: VPN protocols


GRE and ESP are protocols, not ports, so they are transported through on
configured ports.  In Cisco, you permit gre and esp through for the VPN
traffic.

In a conduit statement:

conduit permit esp any any
conduit permit esp any any

notice that there is no tcp, udp, or ip in the permit statement.

I've noticed that, on some firewalls, it is buried deep in the bowels of
the config, and has timeouts set to drop the protocol after so many
minutes.