• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 567
  • Last Modified:

Need help opening ports over Cisco site-to-site VPN

I've got a site-to-site VPN running on a pair of Cisco 5510 firewalls.  One end is with me at my primary site and the other several miles away at a datacenter.  I'd like to find out which ports are open across the VPN and which are not prior to attempting some installs at the datacenter.  Is there an easy way to tell using the ASDM interface?  I would also need to know how to open specific ports if I find that they are closed.  Thanks in advance for any help!
0
First Last
Asked:
First Last
  • 3
  • 3
2 Solutions
 
mcsweenSr. Network AdministratorCommented:
Log into the CLI on your firewall and post the result from the show run command issued from enable mode.  Remember to remove any sensitive information before posting.
0
 
fgasimzadeCommented:
Ports open depend on the access-lists with interesting traffic configured. Usually all tcp/ip ports are open from local subnet to remote subnet
0
 
First LastAuthor Commented:
Ok, that took some serious time to clean out the sensitive info but here we go, its attached here.  Thank you for helping me out!
ASA.txt
0
The IT Degree for Career Advancement

Earn your B.S. in Network Operations and Security and become a network and IT security expert. This WGU degree program curriculum was designed with tech-savvy, self-motivated students in mind – allowing you to use your technical expertise, to address real-world business problems.

 
fgasimzadeCommented:
Do  sh run all, see if you have sysopt connectipn permit-vpn enabled. if yes then all ports are open for ipsec traffic. if no then take a look at your fios access in access lists, everything that is permitted there is permittedfor vpn
0
 
First LastAuthor Commented:
Ok, I ran that and did find this entry:  sysopt connection permit-vpn

So I'm assuming that all the ports are open for ipsec.  Last question to bug you with...the install is for another Exchange 2010 server for redundancy.  Do you happen to know if exchange would use any ports or protocols that could be blocked even though I'm seeing that line in the config?  I ask because at one point I had some major problems with the two server communicating and wound up having to shut down the instance at the datacenter.
0
 
fgasimzadeCommented:
I remember I had problems with inspect smtp, make sure you disable it with no inspect smtp under global policy (in the end of the config)
0
 
First LastAuthor Commented:
Thanks fgasimzade, I will give that a shot now.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

  • 3
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now