Re: [pfSense] Are WAN rules needed for ISAKMP and ESP?

2014-03-01 Thread Chris Buechler
On Fri, Feb 28, 2014 at 3:27 PM, Brian Candler b.cand...@pobox.com wrote: Is it necessary to add explicit rules to allow inbound ISAKMP (UDP 500) and ESP (IP protocol 50) on the WAN interface? If you have the auto-added VPN rules disabled, then yes. Otherwise that's taken care of behind the

[pfSense] Are WAN rules needed for ISAKMP and ESP?

2014-02-28 Thread Brian Candler
Is it necessary to add explicit rules to allow inbound ISAKMP (UDP 500) and ESP (IP protocol 50) on the WAN interface? I had a problem with pfsense 2.0.1 failing to accept sessions initiated by a Cisco ASA5505. tcpdump showed the ASA was sending ISAKMP phase 1 and pfsense was not replying. I

Re: [pfSense] Are WAN rules needed for ISAKMP and ESP?

2014-02-28 Thread Ryan Coleman
I believe so. I have two ports opened under Rules for my IPSEC configuration. On Feb 28, 2014, at 3:27 PM, Brian Candler b.cand...@pobox.com wrote: Is it necessary to add explicit rules to allow inbound ISAKMP (UDP 500) and ESP (IP protocol 50) on the WAN interface? I had a problem with