Solved: VPN and port forwarding issue

Hi Federico,

I have a similar problem and searching the Internet for an answer I found your post, which may provide an answer to my problem.

The scenario is, I have a router facing the ISP. This router terminates various, about 8 IPSec VPNs, from other sites. At the same time, I need to configure port forwarding in this router to send AnyConnect VPN clients to authenticate with the VPN server, which is an ASA firewall behind the router. The problem is, AnyConnect uses IPSec as well and therefore, the port forwarding command stops the IPSec to other sites from forming because both use port 500.

You answer in this post suggests that I could selectively choose what addresses NOT to forward if I configure a route-map with an ACL because I know the source addresses of the remote sites trying to form an IPSec with this router, but I do not know the IP addresses from where our employees try to connect to the VPN server.

Therefore, I wonder if this could work.

ip nat inside source static tcp 10.10.10.10 500 9.9.9.9 500 route-map VPN

!

!

access – list is deny 120 deny udp host 1.1.1.1 eq isakmp host 9.9.9.9 eq isakmp

access – list is deny 120 deny udp host 2.2.2.2 eq isakmp host 9.9.9.9 eq isakmp

access-list 120 deny udp host 3.3.3.3 eq isakmp host 9.9.9.9 eq isakmp

access-list 120 deny udp host 4.4.4.4 eq isakmp host 9.9.9.9 eq isakmp

access-list 120 permit ip any any

!

!

route – map VPN is permit permit 10

match ip address 120

10.10.10.10 =   The address of the VPN server

9.9.9.9 = The external address of the router given to me by the ISP

1.1.1.1, 2.2.2.2 and so on are the source addresses of the remote sites trying to form an IPSec with this router.

With this configuration I am hoping port forwarding will only work for users trying to reach the VPN server for authentication, but at the same time the negotiation to form an IPSec from the remote sites with this router will still go ahead and complete.

What do you or anyone think?

I have a discussion opened for this issues in case you prefer to answer there:

https://community.cisco.com/t5/vpn-and-anyconnect/port-forwarding-for-anyconnect-having-an-impact-on-ipsec/m-p/3703898#M146434