I am trying to allow VNC through my ASA,
i have a policy that allows traffic full access to both the local and remote networks.
everytime i try to vnc to one of the machines i get the following error
6 Oct 22 2009 08:54:58 109025 10.165.165.238 4663 10.165.180.20 5900 Authorization denied (acl=Texas_Users) for user '<unknown>' from 10.165.165.238/4663 to 10.165.180.20/5900 on interface Inside using TCP
if i change the ACE to IP instead of TCP/5900 it works, But my boss want it more restricted
i have the access list attached
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Yes, i have tried it both ways... i just tried it again anf the tried to use the telent command above
tellent returns message could not open connection to host....
The ASA log is showing
Authorization denied (acl=Texas_Users) for user '<unknown>' from 10.165.165.238/1368 to 10.165.180.20/5900 on interface Inside using TCP
When you say you tried it both ways did you make a separate statement for TCP and UDP or only make a statement for TCP. So your above config has
access-list Texas_Users extended permit object-group TCPUDP 10.165.180.0 255.255.255.0 vlan165 255.255.255.0 eq 5900
Have you tried
access-list Texas_Users extended permit object-group TCP 10.165.180.0 255.255.255.0 vlan165 255.255.255.0 eq 5900
access-list Texas_Users extended permit object-group UDP 10.165.180.0 255.255.255.0 vlan165 255.255.255.0 eq 5900
or did you just try
access-list Texas_Users extended permit object-group TCP 10.165.180.0 255.255.255.0 vlan165 255.255.255.0 eq 5900
Many applications will initiate using UDP and then traverse to TCP....An IP statement would include both.
Hope this helps!
This should be a straight forward problem and so I thought I would just do a cold boot on my brain and start all over. So I went back to the beginning and looked at your error message again.
From the message it would appear that 10.165.165.238 talking on port 4663 is being denied access to 10.165.180.20 listening on port 5900 by the Access List Texas_Users.
OK established that we are having problems getting 10.165.165.0 to 10.165.180.0 on port 5900
Wait a minute. Your access list is for traffic coming from the 10.165.180.0 and going to the 10.165.165.0 network on port 5900..AHA
so let's remove the
access-list Texas_Users extended permit tcp 10.165.180.0 255.255.255.0 vlan165 255.255.255.0 eq 5900
and the
access-list Texas_Users extended permit udp 10.165.180.0 255.255.255.0 vlan165 255.255.255.0 eq 5900
and instead do
access-list Texas_Users extended permit tcp vlan165 255.255.255.0 10.165.180.0 255.255.255.0 eq 5900
no need to worry about UDP I have since found out that VNC does not use UDP what-so-ever
OK....couple more questions.
Are you initiating the VNC session from your machine on vlan165 to the 10.165.180.0 subnet...what subnet does the person initiating the connection sit on and what subnet does the machine listening on port 5900 sit on. From you errors it appears that the connection is being initiated from vlan165 and is going to connect to a machine on 10.165.180.0....correct?
the VNC session will always be initialized from Vlan 165 (this is the local network) our techs use VNC to assist remote clients.
Local machines on 10.165.165.0/24 will always be the initiating machines
The remote host will always be on 10.165.180.0/24 listening on port 5900
Yes, your last statment is correct....
I have also found that if i configure the ACL to use tcp with no port assigned this will work, still leaves the network open too much.
OK...I think I might know what is happening here. The remote side is connecting via a remote vpn connection to your network. You are trying to initiate a VNC connection from your side while the remote vpn is connected. When you specify the port address in the VPN Filter ACL for Texas_Users then it will not allow you to send traffic to their subnet because your traffic doesn't match the port filter...you send out on a non specific port each time. SO I think you have to leave the
access-list Texas_Users extended permit tcp vlan165 255.255.255.0 10.165.180.0 255.255.255.0
and then add (right after the above statement)
access-list Texas_Users extended permit tcp 10.165.180.0 255.255.255.0 vlan165 255.255.255.0 5900
I believe that will allow you to send on any non specific port and restrict their communications to port 5900
You can test this by a telnet session from their machine to a local machine on your subnet on port 5901
I think the problem is that the connection is being initiated from your end of the tunnel and the ACL is applied as a VPN Filter that is subject to Authentication....normally
Here take a look at this link. It will kind of explain a little further what I meant by them initiating the connection. Make sure and take note that the connection uses a different port...5500 I believe. You will need to allow that port in the ACL instead of 5900. Lots of people use this just as the forum describes, to access a computer behind a firewall they do not control. In this case it is to access a computer behind a firewall that isn't behaving. Anyway just an idea.
http://faq.gotomyvnc.com/f
Business Accounts
Answer for Membership
by: rsivanandanPosted on 2009-10-22 at 08:37:57ID: 25635461
Instead of that object-group have you tried just with tcp/5900 ?
When you put in that acl, can you try to do this;
telnet <remote-ip> 5900 and hit enter,
Cheers,
rsivanandan