Fabric Extend behind Firewall

[Configterminal]

Hi, I am going to be setting up fabric extend using a pair of XA1480s.  The headend switch will be in a data center behind a firewall.  The other, at a remote location plugged directly into the internet circuit.

For the DC side, I am planning on creating a DNAT rule on the firewall to allow inbound connectivity from the internet.  My question is, is there a KB that indicates what ports are needed to be allowed to get the tunnel up?  Is it just IPSEC?

thanks 

[EF · Accepted solution]

Hi,

I belive only UDP 4500 is needed:

source "VOSS User Guide (extremenetworks.com)"

Best!!!

EF

[Configterminal]

This is perfect thank you sir!