topic Dynamic ports block for AD Server in General Topics

Dynamic ports block for AD Server

samtech4u — Thu, 01 Aug 2019 08:29:26 GMT

Hi,

guys i need a help from you. one of our cutomer has AD servers between a IPSec vpn tunnel. from ADserver 49152-65535 dynamics ports are not open, .both tunnel source and destination all ports are allowed.but there's no logs that prevent those ports Is there any specific configuration should do to allow those traffic?

Re: Dynamic ports block for AD Server

_Val_ — Fri, 02 Aug 2019 10:43:47 GMT

It should work out of the box with ANY-ANY-Accept on the VPN rule. Do you see any suspicious drops?

Re: Dynamic ports block for AD Server

Wolfgang — Fri, 02 Aug 2019 11:42:41 GMT

For the dynamic communication via Microsoft protocols you can use the "ALL_DCE_RPC" service. With these service you allow the dynamicly used high ports, without defined them explicitly.

Follow configuration of rules with service all_dce_rpc

regards

Wolfgang

Re: Dynamic ports block for AD Server

_Val_ — Fri, 02 Aug 2019 11:54:19 GMT

Right, @Wolfgang, that would be my second question. Without that, however, one should see some "telling" drops.

Re: Dynamic ports block for AD Server

Norbert_Bohusch — Fri, 02 Aug 2019 18:30:19 GMT

What connection do you have between the two VPN peers? It might be a MTU related issue.

Lowering ext. IF MTU or enabling MSS clamping for VPN might help in such cases.

You may test by using ping with bigger packet sizes and setting DF bit.