port 4500 ? rien trouvé sur ce port

[nl]

J'essaye d'établir un vpn entre 2 ipcop 1.3 fix8 (sans succès) <BR> <BR>Dans les logs de ma 1ere box, le firewall bloque les requêtes de ma 2ème box sur le port 4500. Qu'est-ce que cela veut dire ? Est-ce que cela a voir avec mon vpn ?

[nl]

J'ai trouvé : <BR> <BR><!-- BBCode auto-link start --><a href="http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/deployguide/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/all/deployguide/en-us/dnsbj_ips_schx.asp" target="_blank">http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/deployguide/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/all/deployguide/en-us/dnsbj_ips_schx.asp</a><!-- BBCode auto-link end --> <BR> <BR>C'était bel et bien les négociations d' IKE. <BR> <BR>Par contre, je ne comprends pas pourquoi mon firewall les bloques, alors que c'est de l'ipsec ??? <BR>

[nl]

Ca peut aider : <BR> <BR><!-- BBCode auto-link start --><a href="http://www.vpnc.org/ietf-ipsec/02.ipsec/msg02485.html" target="_blank">http://www.vpnc.org/ietf-ipsec/02.ipsec/msg02485.html</a><!-- BBCode auto-link end --> : <BR> <BR>The NAT-T protocol stuff does not change even if you start directly on <BR>port 4500 (rekey or preconfiguration), i.e you send normal Vendor-ID, <BR>NAT-D etc stuff and detect NAT normally. Only thing that is left out <BR>is the changing of the port if NAT is detected. <BR> <BR>There is also possibility that some clients start directly to port <BR>4500 instead of 500 if they know that the other end support NAT-T (i.e <BR>preconfigured). They will do that before they know if there is NAT <BR>between. If the NAT is then detected they will use the UDP <BR>encapsulation otherwise they will use normal IPsec transport / tunnel <BR>mode. <BR>---------------------------------------------------------------------- <BR>... <BR>Similarly, if the responder needs to rekey the phase 1 SA, then he MUST <BR>start the negotiation using UDP(4500,Y). Any implementation that <BR>supports NAT traversal, MUST support negotiations that begin on port <BR>4500. If a negotiation starts on 4500, then it doesn't need to change <BR>anywhere else in the exchange. <BR> <BR>

[popoch]

je confirme : <BR> <BR>ipsec-msft 4500/tcp Microsoft IPsec NAT-T <BR>ipsec-msft 4500/udp Microsoft IPsec NAT-T <BR> <BR> <BR>c est dans la liste des ports de l iana.