TCP and UDP Ports used for the Cisco VPN Client

Posted by: Rob Chee on Jan 23, 2009 Print 

Tagged in: VPN , UDP Ports , TCP Ports , PAT , NAT Traversal , Cisco VPN Client

The Cisco VPN client is the client side application used to encrypt traffic from an end user's computer to the company network. IPSec is used to encrypt the traffic. When using standard IPSec, IKE is used for the key negotiation and IPSec to encrypt the data. IKE uses UDP port 500 and IPSec uses IP protocol 50, assuming ESP is used.

In most situations, there is a PAT device between the VPN client and the head end VPN device. PAT works by differentiating users by the UDP or TCP port used. Since IPSec uses IP protocol 50, it is impossible for more than one user to connect to the VPN device, through the PAT. This is because the IP protocol operates at layer 3 of the OSI reference model and PAT functionality exists at layer 4. For this reason, there are three different methods of tunneling IPSec traffic. It is important to understand the ports used for the different methods to ensure that those ports are not blocked.

  1. NAT Traversal - This method still uses 500/udp for IKE negotiation, but then tunnels IPSec data traffic within 4500/udp packets. This is the default method for UDP tunneling with the Cisco VPN client
  2. IPSec over UDP - This method still uses 500/udp for IKE negotiation, but then tunnels IPSec data traffic within a pre-defined UDP port. The default port for this traffic is 10000/udp.
  3. IPSec over TCP - This method tunnels both the IKE negotiation and IPSec data traffic within a pre-defined TCP port. The default port for this traffic is 10000/tcp. This is the only method that tunnels both IKE and IPSec within the same stream.
Posted by Rob Chee
Comments (0)Add Comment
feedSubscribe to this comment's feed

Write comment

busy

[ Back ]