Clarity needed

[localzuk]

Could someone explain to me what requirements an IPSec site-to-site VPN would have? Ie. in terms of port opening?

 

I understand I'd need to put in place routing rules to pass traffic to the VPN device, just need to make sure I could actually get the ports I'd need opened for such a thing.

[SchoolsBroadband]

are one of the VPN devices hidden behind a NAT device I presume? i.e the VPN devices do not have their own real world IP address assigned to their WAN port behind a nat'd firewall?

[SchoolsBroadband]

port wise the below should do the trick

 

IP Protocol Type=UDP, UDP Port Number=500 <- Used by IKEv2 (IPSec control path)

IP Protocol Type=UDP, UDP Port Number=4500 <- Used by IKEv2 (IPSec control path)

IP Protocol Type=UDP, UDP Port Number=1701 <- Used by L2TP control/data path

IP Protocol Type=50 <- Used by data path (ESP)

 

Also make sure you use aggressive mode in the handshake

 

Finally some firewalls need you to turn off the IPSEC functionality within them for port forwarding to work e.g. on Drayteks. Make sure you are doing that too.

 

And super finally if one device is behind a nat'd firewall and the other isn't then try to get the VPN device that's behind the nat'd firewall to initiate the connection rather than the other way around.

 

Good luck!

 

Dave