Cull the Port and Protocol for Mobile VPN with SSL

The default protocol and port for Mobile VPN with SSL is TCP port 443, which is usually open up on most networks. If you effort to configure the Firebox to use a port and protocol that is already in use, you run into an mistake bulletin.

Common network configurations that crave TCP 443 include:

  • The Firebox protects a web server that uses HTTPS.
  • The Firebox protects a Microsoft Commutation server with Outlook on the spider web (Microsoft Outlook Spider web Admission) configured.

If you accept an additional external IP accost that does non accept incoming TCP port 443 connections, you lot can configure it as the primary IP accost for Mobile VPN with SSL.

Mobile VPN with SSL traffic is always encrypted with SSL, even if you utilize a dissimilar port or protocol.

How to Choose a Dissimilar Port and Protocol

If you lot need to change the default port or protocol for Mobile VPN with SSL, we recommend that you lot choose a port and protocol that is not commonly blocked. Some boosted considerations include:

Select a mutual port and protocol

Other mobile VPN types on the Firebox use specific ports and protocols that are blocked past some public Internet connections. By default, Mobile VPN with SSL operates on the port and protocol used for encrypted website traffic (HTTPS) to avert being blocked.

Another chief advantage of SSL VPN over other mobile VPN types is that you lot tin change the port as well every bit the protocol (UDP or TCP). If users cannot connect to the Firebox over TCP 443, 1 possible solution is to change the port or protocol. For example, change the port and protocol to UDP 53 or UDP 1194 and determine whether users can connect.

If the access site uses package filters, the SSL VPN traffic should pass. If the access site uses proxies, the SSL VPN traffic is probable to be denied because information technology does not follow standard HTTP or DNS communications protocols.

UDP versus TCP

Normally TCP works besides as UDP, but TCP tin be significantly slower if the connectedness is already slow or unreliable. The additional latency is caused by error checking that is role of the TCP protocol. Considering the bulk of traffic that passes through a VPN tunnel uses TCP, the addition of TCP error checking to the VPN connection is redundant. With slow and unreliable connections, TCP fault checking timeouts cause VPN traffic to exist sent more and more than slowly. If this happens enough times, users might find the poor connection performance.

UDP is a good choice if the majority of the traffic generated by your Mobile VPN with SSL clients is TCP-based. The HTTP, HTTPS, SMTP, POP3 and Microsoft Exchange protocols all employ TCP by default. If the majority of the traffic generated past your Mobile VPN with SSL clients is UDP, nosotros recommend that you select TCP as the protocol for the Mobile VPN with SSL.

Mobile VPN with SSL shares an OpenVPN server with Management Tunnel over SSL, BOVPN over TLS, and the Admission Portal. If whatsoever of these features are enabled on your Firebox, Mobile VPN with SSL port settings are affected. For more than information about port settings precedence, see Manually Configure the Firebox for Mobile VPN with SSL and SSL/TLS Settings Precedence and Inheritance.

See Also

About Mobile VPN with SSL

Troubleshoot Mobile VPN with SSL

SSL/TLS Settings Precedence and Inheritance