PIX and VPN over TCP

isakmp nat-traversal 20

It doesn't matter that they are going through devices that do not have NAT-T: the VPN client itself will do NAT-T. If the PIX has NAT-T enabled and the VPN clients are having problems getting through, then the implication is that UDP 500 or UDP 4500 is blocked -- and if that is the case, one would expect that TCP 10000 may well be blocked as well.

That is true for PIX 6.3, which the url you give is for ("v_63"), but I seem to recall reading that there is are more tunneling options for PIX 7.x, which a 515E might be running.

Yes, but You can change the port with isakmp ipsec-over-tcp port command.

Hi!

Hmm! It seem that you guys are right - this not NAT-T problem, as I have already turned it on with "isakmp nat-traversal 20". It may be due to blocking UDP ports.

but Jyri has said:

So, could I configure my PIX to use only one TCP or UDP port (preferable using one of "well known port") or not?

Krzysztof

The command I wrote works well on ASA and I forgot to add it to the previous post :-). Take a look at a PIX Configuration Guide and a Command Reference for Your OS version - It's all there.

Hi!

There is no "isakmp ipsec-over-tcp port" command or anything similar, so final conclusion is: I CAN'T change TCP/UDP ports used by PIX for IPSec tunnels :-( (I have version 6.3)

Best Regards:

Krzysztof