New Member

Question

IPsec TCP port per tunnel

Forum|Forum|1 year ago
November 4, 2024
7 replies
5821 views

I have 3 vpn connections:

1. Azure - mainsite FG (ipsec)

2. branchsite FG - mainsite FG (ipsec)

3. clients - mainsite FG (ssl-vpn)

With the new ike-port option is should be possible to move to ip-sec over port 443.

config system settings
set ike-port 443
end

This sets the port globally though. I can get around this for tunnels 2 and 3, but Azure site-to-site VPN does not have an option to change port (or use tcp). Is it possible to change the port per tunnel? If not, is this on the roadmap?

dkochhar

Staff

@Knuppel1983 Unfortunately, this is a global feature. This setting is not available per tunnel for now.

Knuppel1983Author

New Member

Hi Dixit, thanks for your reply. Is this on the roadmap? Or are there talks with vendors like Microsoft to support TCP IPsec? I can't imagine being the only one facing this problem.

sw2090

SuperUser

why do you want that? IPSec tunnels can coexist on the same port because the should usually differ by psk and/or peerid. Also if you enable NAT-Traversal you will need a second port.

Knuppel1983Author

New Member

The problem is not multiple tunnels co-existing on the same port.

The problem is certain devices and services (Azure) not supporting IPSec TCP. This puts me in the situation where Fortinet is removing and thus wants me to move away from SSL-VPN, but the 'set ike-port 443' port change having effect on not just the IPSec client tunnel, but all tunnels.

sw2090

SuperUser

ah ok now I understand it :)

sw2090

SuperUser

though FortoOS uses the default IPSec ports: 500/UDP and 4500/UDP (for NAT-T). So there is no IPSec TCP afaik.

Knuppel1983Author

New Member

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-TCP-as-transport-for-IKE-IPsec-traffic/ta-p/300834

sw2090

SuperUser

ya that's a new feature added in 7.4 which we don't yet use. So I cannot say much helpful things on 7.4 though. BUt from that article I see that in 7.4 it is possible to switch IPSec transport from udp to tcp in 7.4. It says per default it then uses 4500/TCP. There is an option to change the port but this is global...and that's were your problems start.

So you mean Azure etc only support 443/tcp and that's why you need to change the port?

Knuppel1983Author

New Member

Correct. I think Azure only supports the default UDP IPSec ports, there is no way of changing them. This would also apply to other non-Fortinet devices. I can alter the phase1-interface to 'set transport udp' but this doesn't seem to work.

Haven't extensively tested yet though.

sw2090

SuperUser

I gues in this case you cannot blame fortinet. POrt 500 and 4500 are IPSec standard defined in rfc #7296. So it is the other side that doesn't support the standards. And M$ keeps it with the words of Adam Savage: "I reject your reality and substitute my own!" :)

sw2090

SuperUser

Oh m$ does support the defaults?! How did that happen xD

Well it is correct that you cannot change them because they are stadardized (as said defined in rfc #7296). So to support as much IPSec as possible you usually do not allow to chang them.

But if they do then I don't understand whay you need to change that?

Knuppel1983Author

New Member

Haha. Not putting blame anywhere, just want a working solution.

Can anyone else test if TCP and UDP IPSec tunnels can co-exist?
For reference: https://infosecmonkey.com/tcp-encpsulation-of-esp-packets-for-vpn-tunnels/

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded