RE: VPN protocols

From: Keith Pachulski (keithp_at_corp.ptd.net)
Date: 12/22/04

  • Next message: robert_at_dyadsecurity.com: "Re: Port Scanning." 
    Date: Wed, 22 Dec 2004 14:21:56 -0500
To: "John Forristel (SunGard-Chico)" <John.Forristel@sungardbi-tech.com>, "Dan Tesch" <dan.tesch@comcast.net>, "Pen Test" <pen-test@securityfocus.com>

    GRE and ESP are IP Protocols.

    On nearly all modern firewalls you specify the ip transport [esp, ah, gre, other] between the two networks. Conduits for the msot part are being phased out so on an IOS device or PIX the line would be something like this when configured correctly

    access-list ingress permit esp host <remote-host-ip> host <local-ip>
    access-list ingress permit udp host <remote-host-ip> host <local-ip> eq 500

    this will permit most IPSEC vpns to work between two permitted termination points. permitting all hosts to transport vpn traffic is not the best design. Doing so helps pentesters and blackhat gain more information on your device configuration than they need.

    -keith

    -----Original Message-----
    From: John Forristel (SunGard-Chico)
    [mailto:John.Forristel@sungardbi-tech.com]
    Sent: Wednesday, December 22, 2004 12:04 PM
    To: Dan Tesch; Pen Test
    Subject: RE: VPN protocols

    GRE and ESP are protocols, not ports, so they are transported through on
    configured ports. In Cisco, you permit gre and esp through for the VPN
    traffic.

    In a conduit statement:

    conduit permit esp any any
    conduit permit esp any any

    notice that there is no tcp, udp, or ip in the permit statement.

    I've noticed that, on some firewalls, it is buried deep in the bowels of
    the config, and has timeouts set to drop the protocol after so many
    minutes.

  • Next message: robert_at_dyadsecurity.com: "Re: Port Scanning."

    Relevant Pages

    • Re: Nach Update auf Enterprise Edition keine L2TP Verbindung möglich
      ... Name, Protokoll, Port, Ziel, an Port ... "VPN ESP", ESP, 192.168.115.11 ... "VPN GRE", GRE, 192.168.115.11 ...
      (microsoft.public.de.german.windows.server.networking)
    • Re: VPN protocols
      ... you permit gre and esp through for the VPN ... they are not transported on configured ports. ...
      (Pen-Test)
    • VPN protocols
      ... has an edge router which has several site-to-site VPN's set up ... A standard Nessus scan shows 1723 but doesn't pick up gre or esp ...
      (Pen-Test)
    • RE: VPN protocols
      ... GRE and ESP are protocols, not ports, so they are transported through on ... configured ports. ... you permit gre and esp through for the VPN ...
      (Pen-Test)