Solved

Need help opening ports over Cisco site-to-site VPN

Posted on 2013-01-10
7
559 Views
Last Modified: 2013-01-10
I've got a site-to-site VPN running on a pair of Cisco 5510 firewalls.  One end is with me at my primary site and the other several miles away at a datacenter.  I'd like to find out which ports are open across the VPN and which are not prior to attempting some installs at the datacenter.  Is there an easy way to tell using the ASDM interface?  I would also need to know how to open specific ports if I find that they are closed.  Thanks in advance for any help!
0
Comment
Question by:First Last
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
7 Comments
 
LVL 22

Expert Comment

by:mcsween
ID: 38763776
Log into the CLI on your firewall and post the result from the show run command issued from enable mode.  Remember to remove any sensitive information before posting.
0
 
LVL 18

Expert Comment

by:fgasimzade
ID: 38763846
Ports open depend on the access-lists with interesting traffic configured. Usually all tcp/ip ports are open from local subnet to remote subnet
0
 
LVL 1

Author Comment

by:First Last
ID: 38764327
Ok, that took some serious time to clean out the sensitive info but here we go, its attached here.  Thank you for helping me out!
ASA.txt
0
Surfing Is Meant To Be Done Outdoors

Featuring its rugged IP67 compliant exterior and delivering broad, fast, and reliable Wi-Fi coverage, the AP322 is the ideal solution for the outdoors. Manage this AP with either a Firebox as a gateway controller, or with the Wi-Fi Cloud for an expanded set of management features

 
LVL 18

Accepted Solution

by:
fgasimzade earned 500 total points
ID: 38764368
Do  sh run all, see if you have sysopt connectipn permit-vpn enabled. if yes then all ports are open for ipsec traffic. if no then take a look at your fios access in access lists, everything that is permitted there is permittedfor vpn
0
 
LVL 1

Author Comment

by:First Last
ID: 38764403
Ok, I ran that and did find this entry:  sysopt connection permit-vpn

So I'm assuming that all the ports are open for ipsec.  Last question to bug you with...the install is for another Exchange 2010 server for redundancy.  Do you happen to know if exchange would use any ports or protocols that could be blocked even though I'm seeing that line in the config?  I ask because at one point I had some major problems with the two server communicating and wound up having to shut down the instance at the datacenter.
0
 
LVL 18

Assisted Solution

by:fgasimzade
fgasimzade earned 500 total points
ID: 38764433
I remember I had problems with inspect smtp, make sure you disable it with no inspect smtp under global policy (in the end of the config)
0
 
LVL 1

Author Comment

by:First Last
ID: 38764441
Thanks fgasimzade, I will give that a shot now.
0

Featured Post

Simple, centralized multimedia control

Watch and learn to see how ATEN provided an easy and effective way for three jointly-owned pubs to control the 60 televisions located across their three venues utilizing the ATEN Control System, Modular Matrix Switch and HDBaseT extenders.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Lost emails in Outlook 18 40
Export and Import an SPA 8000 config 7 18
exchange 13 25
Fortigate SSL-VPN Split Tunneling question 4 19
Finding original email is quite difficult due to their duplicates. From this article, you will come to know why multiple duplicates of same emails appear and how to delete duplicate emails from Outlook securely and instantly while vital emails remai…
Large Outlook files lead to various unwanted errors and corruption issues. Furthermore, large outlook files can also make Outlook take longer to start-up, search, navigate, and shut-down. So, In this article, i will discuss a method to make your Out…
To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

733 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question