Home / server / Questions / 400506
Accepted
Alain O'Dea
Asked: 2012-06-21 04:14:55 +0800 CST

How can I prevent inside hosts from taking ISAKMP and IPSec NAT-T ports on 8.4 ASA5510?

  • 772

I have configured a Remote Access VPN on my ASA5510 running 8.4 and enabled it on the outside interface.

For some reason if an inside host uses a VPN client to connect through the firewall they end up taking port udp/500 (udp/isakmp) or tcpudp/4500 (IPSec NAT-T).

Inside hosts use PAT to translate to the outside, but I would have thought the ASA would never provide PAT translations that override its own ports (like 500 and 4500).

I am seeing the packets drop during negotiation and authentication. If I disconnect the VPN client on the inside host the remote access clients can connect again.

Here is some of the config (scrubbed for obvious reasons):

access-list vpnclient_splitTunnelAcl standard permit 10.0.0.0 255.0.0.0
ip local pool vpnclient-pool 10.0.254.5-10.0.254.249 mask 255.255.255.0
group-policy remote_access internal
group-policy vpnclient attributes
 dns-server value 10.0.0.2
 vpn-tunnel-protocol ikev1
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value vpnclient_splitTunnelAcl
 default-domain value example.local
tunnel-group vpnclient type remote-access
tunnel-group vpnclient general-attributes
 address-pool vpnclient-pool
 authentication-server-group RADIUS
 default-group-policy vpnclient
tunnel-group vpnclient ipsec-attributes
 ikev1 pre-shared-key ***********
tunnel-group vpnclient ppp-attributes
 no authentication chap
 no authentication ms-chap-v1

How can I prevent inside hosts from taking ISAKMP and IPSec NAT-T ports on 8.4 ASA5510?

cisco-vpn cisco-asa

2 Answers

  1. Do you have crypto isakmp nat-traversal 20 enabled on the destination and source firewalls? This is a common issue, and bits of your story are consistent. There may be something else off in the config, though. Can you post the rest?

    • 2
  2. Best Answer

    A combination of IPSec Pass-through and a NAT hack resolves the issue with ports 500 and 4500 being 'stolen' by inside hosts for me:

    configure terminal
 object network VPN-endpoint
  description Prevent inside hosts from stealing VPN endpoint with PAT
  host 172.16.0.1
  nat (any,outside) static interface service udp isakmp isakmp
  exit
 access-list ipsecpassthroughacl extended permit udp any any eq isakmp
 access-list ipsecpassthroughacl extended permit object-group TCPUDP any any eq 4500
 class-map ipsecpassthru-traffic
  match access-list ipsecpassthroughacl
  exit
 policy-map type inspect ipsec-pass-thru iptmap
  parameters
   esp
   ah
   exit
  exit
 policy-map inspection_policy
  class ipsecpassthru-traffic
   inspect ipsec-pass-thru iptmap
   exit
  exit
 service-policy inspection_policy interface outside
 exit
    • 1