I have a internal user that needs to connect via VPN to an external company. The external company's vpn is using IPSec over TCP on port 57369. When my user tries to connect it fails. The logs on my ASA show the following. Deny TCP (no connection) from 172.x.x.x/1155 to 167.x.x.x/57369 flags RST on interface Inside

How do I allow this traffic through my ASA?


  • is this address range associated with the external company? if show you could allow in running config. can you provide more detail with your question?
    – Patrick R
    Jan 29, 2010 at 17:24
  • The external company's IP is My internal network is 172.x.x.x. It's odd that the firewall is denying an internal address from going out.
    – Matt
    Jan 29, 2010 at 18:12

2 Answers 2


Try adding this to your asa config:

policy-map global_policy
  class inspection_default
    inspect ipsec-pass-thru 
  • Thanks for the reply, but still have the same issue.
    – Matt
    Jan 29, 2010 at 18:00
  • ipsec-passthru is for regular ipsec traffic. He is talking about IPSec over TCP.
    – einstiien
    Jan 29, 2010 at 18:28
  • Sorry, my fault for misreading the question. If you post your config and output of sh ver I will have a look. What you are trying to do should just work, I have the same setup in a number of offices.
    – smithian
    Jan 29, 2010 at 19:37

After capturing the traffic and testing some different setting. The problem looks like its on the remote side, not my ASA. I confirmed with Cisco that I'll I need to do is have inspect ipsec-pass-thru.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.