Allowing isakmp and esp traffic any any acceptable risk?

[balrog259]

Hello,

I have a Cisco 871 using NAT waiting for another router with a Dynamic IP to establish an ipsec VPN tunnel. I was successful in getting another router to establish an ipsec VPN tunnel using a pre-shared key, however the one thing that I don't like is that I had to make a concession and add the following lines to my outside interface:

ip access-list extended ALLOWED-FROM-INTERNET
permit udp any any eq isakmp
permit esp any any

How much of a risk does allowing this traffic from any to any into the router, considering that the only tunnel that should be able to establish needs the pre-shared key?

Is there a better of doing this that I missed?

Thank you in advance.

Balrog259