Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a internal user that needs to connect via VPN to an external company. The external company's vpn is using IPSec over TCP on port 57369. When my user tries to connect it fails. The logs on my ASA show the following. Deny TCP (no connection) from 172.x.x.x/1155 to 167.x.x.x/57369 flags RST on interface Inside

How do I allow this traffic through my ASA?


share|improve this question
is this address range associated with the external company? if show you could allow in running config. can you provide more detail with your question? – Patrick R Jan 29 '10 at 17:24
The external company's IP is My internal network is 172.x.x.x. It's odd that the firewall is denying an internal address from going out. – Matt Jan 29 '10 at 18:12
up vote 2 down vote accepted

Try adding this to your asa config:

policy-map global_policy
  class inspection_default
    inspect ipsec-pass-thru 
share|improve this answer
Thanks for the reply, but still have the same issue. – Matt Jan 29 '10 at 18:00
ipsec-passthru is for regular ipsec traffic. He is talking about IPSec over TCP. – einstiien Jan 29 '10 at 18:28
Sorry, my fault for misreading the question. If you post your config and output of sh ver I will have a look. What you are trying to do should just work, I have the same setup in a number of offices. – smithian Jan 29 '10 at 19:37

After capturing the traffic and testing some different setting. The problem looks like its on the remote side, not my ASA. I confirmed with Cisco that I'll I need to do is have inspect ipsec-pass-thru.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.