Penetration Testing mailing list archives
RE: VPN protocols
From: "Keith Pachulski" <keithp () corp ptd net>
Date: Wed, 22 Dec 2004 14:21:56 -0500
GRE and ESP are IP Protocols. On nearly all modern firewalls you specify the ip transport [esp, ah, gre, other] between the two networks. Conduits for the msot part are being phased out so on an IOS device or PIX the line would be something like this when configured correctly access-list ingress permit esp host <remote-host-ip> host <local-ip> access-list ingress permit udp host <remote-host-ip> host <local-ip> eq 500 this will permit most IPSEC vpns to work between two permitted termination points. permitting all hosts to transport vpn traffic is not the best design. Doing so helps pentesters and blackhat gain more information on your device configuration than they need. -keith -----Original Message----- From: John Forristel (SunGard-Chico) [mailto:John.Forristel () sungardbi-tech com] Sent: Wednesday, December 22, 2004 12:04 PM To: Dan Tesch; Pen Test Subject: RE: VPN protocols GRE and ESP are protocols, not ports, so they are transported through on configured ports. In Cisco, you permit gre and esp through for the VPN traffic. In a conduit statement: conduit permit esp any any conduit permit esp any any notice that there is no tcp, udp, or ip in the permit statement. I've noticed that, on some firewalls, it is buried deep in the bowels of the config, and has timeouts set to drop the protocol after so many minutes.
Current thread:
- VPN protocols Dan Tesch (Dec 22)
- RE: [in] VPN protocols Curt Purdy (Dec 22)
- <Possible follow-ups>
- RE: VPN protocols John Forristel (SunGard-Chico) (Dec 22)
- Re: VPN protocols Chris Kuethe (Dec 22)
- RE: VPN protocols Keith Pachulski (Dec 22)