The default protocol and port for Mobile VPN with SSL is TCP port 443. If you try to configure the XTM device to use a port and protocol that is already in use, you see an error message.
Common network configurations that require the use of TCP 443 include:
If you have an additional external IP address that does not accept incoming TCP port 443 connections, you can configure it as the primary IP address for Mobile VPN with SSL.
Mobile VPN with SSL traffic is always encrypted using SSL, even if you use a different port or protocol.
If you need to change the default port or protocol for Mobile VPN with SSL, we recommend that you choose a port and protocol that is not commonly blocked. Some additional considerations include:
Select a common port and protocol
Mobile VPN with PPTP and Mobile VPN with IPSec use specific ports and protocols that are blocked by some public Internet connections. By default, Mobile VPN with SSL operates on the port and protocol used for encrypted web site traffic (HTTPS) to avoid being blocked. This is one of the main advantages of SSL VPN over other Mobile VPN options. We recommend that you choose TCP port 53, or UDP port 53 (DNS) to keep this advantage.
These ports are allowed by almost all Internet connections. If the access site uses packet filters, the SSL traffic should pass. If the access site uses proxies, the SSL traffic is likely to be denied because it does not follow standard HTTP or DNS communications protocols.
UDP versus TCP
Normally TCP works as well as UDP, but TCP can be significantly slower if the connection is already slow or unreliable. The additional latency is caused by the error checking that is part of the TCP protocol. Because the majority of traffic that passes through a VPN tunnel uses TCP, the addition of TCP error checking to the VPN connection is redundant. With slow and unreliable connections, the TCP error checking timeouts cause VPN traffic to be sent more and more slowly. If this happens enough times, the poor connection performance is noticed by the user.
UDP is a good choice if the majority of the traffic generated by your MVPN with SSL clients is TCP-based. The HTTP, HTTPS, SMTP, POP3 and Microsoft Exchange protocols all use TCP by default. If the majority of the traffic generated by your Mobile VPN with SSL clients is UDP, we recommend that you select TCP for the MVPN with SSL protocol.