pix holes for vpn and tunnels

In article , wrote: :Hello I have pix doing tunels to remote sites and vpn, does anyone know :what port ranges i have to open if i want to close all ports?

Traditional (PIX 6.2 or earlier):

- udp port 500 ('isakmp')

- IP protocol 50 'ESP' (not a port number, a -protocol- number!)

- IP protocol 51 'AH' (not a port number, a -protocol- number!) - this is needed only if you have AH turned on in your transforms

Newer (PIX 6.3.x with 'isakmp nat-traversal' turned on)

- the above will be used if they are available and if there is no NAT betweeen the endpoints

- udp port 4500 will be used to probe for NAT

- if NAT is detected, then a dynamic UDP port will be opened automatically, and packets will be sent through that port -instead- of being sent through IP 50; and udp 500 will not not be used once this encapsulation is established

Newest (PIX 7.0)

- AH is not available as a transform

- PIX 7.0 binary hasn't been released, at least not as of an hour ago; in the meantime if you are seriously considering a 7.0 upgrade, read the 7.0 transition documents that become available today.