Ensure ACLs Are Compatible with IPsec
Site 1
Site 1
Site 2
R1# show ip access-lists Extended IP access list 101
10 permit ahp host 172.30.1.2 host 172.30.6.2 20 permit esp host 172.30.1.2 host 172.30.6.2
Site 2
172.30.1.2
172.30.6.2
R1# show ip access-lists Extended IP access list 101
10 permit ahp host 172.30.1.2 host 172.30.6.2 20 permit esp host 172.30.1.2 host 172.30.6.2
IP 51
IP 51
IP 50
IP 50
J"udp
30 permit udp host 172.30.1.2 host 172.30.6.2 eq isakmp < 500 40 permit udp host 172.30.1.2 host 172.30.6.2 eq non500-isakmp
UDP I 4500
© 2007 Cisco Systems, Inc
You will need to ensure that existing ACLs on perimeter routers, the Cisco Adaptive Security Appliance (ASA) or Cisco PIX Firewall, or other routers do not block IPsec traffic. Perimeter routers typically implement a restrictive security policy with ACLs, where only specific traffic is permitted and all other traffic is denied. Such a restrictive policy blocks IPsec traffic, so you need to add specific permit statements to the ACL to allow IPsec traffic.
Ensure that your ACLs are configured so that ISAKMP, ESP, AH, and NAT-T traffic is not blocked at interfaces used by IPsec. ISAKMP uses User Datagram Protocol (UDP) port 500. ESP is assigned IP protocol 50; AH is assigned IP protocol 51; and NAT-T uses UDP 4500. You might need to these statements to router ACLs to explicitly permit this traffic.
You may need to add the ACL statements to the perimeter router by completing the following steps:
Step 1 Examine the current ACL configuration at the perimeter router and determine whether it will block IPsec traffic.
router# show ip access-lists
Step 2 Add ACL entries to permit IPsec traffic.
R1(config)# ip access-list extended 101
R1(config-ext-nacl)# permit ahp host 172.30.1.2 host 172.30.6.2
Securing Networks with Cisco Routers and Switches (SNRS) v2.0
4-42
R1(config-ext-nacl)# permit esp host 172.30.1.2 host 172.30.6.2
R1(config-ext-nacl)# permit udp host 172.30.1.2 host 172.30.6.2 eq isakmkp
R1(config-ext-nacl)# permit udp host 172.30.1.2 host 172.30.6.2 eq 4500
The figure shows an example of an ACL that is compatible with IPsec and should not block any protocols needed to set up the IPsec tunnels.
© 2007 Cisco Systems, Inc. Secured Connectivity 4-43
Continue reading here: Planning the IKE Policy
Was this article helpful?