| 14.3 |  | Task 1 - Prepare to Configure VPN Support |
| 14.3.6 |  | Step 6 - implicitly permit IPSec bypass |

| Even after proper network functionality is tested, it is necessary to ensure that existing access-control lists (ACLs) and conduits do not block IPSec traffic. The PIX is a security device and therefore implements restrictive security policies. This type of restrictive policy blocks IPSec traffic. The administrator will need to add specific permit statements to the ACL or conduit to allow IPSec traffic.

Ensure that the ACLs are configured so that ISAKMP, Encapsulating Security Payload (ESP), and Authentication Header (AH) traffic is not blocked at interfaces used by IPSec. ISAKMP uses UDP port 500. ESP is assigned IP protocol number 50, and AH is assigned IP protocol number 51. In some cases, it might be necessary to add a statement to conduits or ACLs to explicitly permit this traffic.

Another interesting ACL bypass command in the PIX is the following:

> sysopt connection permit IPSec

This command allows encrypted traffic to bypass normal ACLs and conduits and continue to the IPSec access-groups.