• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 575
  • Last Modified:

cisco vpn filter rules for limiting traffic

I have a vpn3005 and I need to limit a group of dialin users (ip's 192.168.2.0) who use the Cisco vpn software client to ONLY access one server (192.168.1.20) in the vpn network and ONLY email traffic to that exchange server.  I know I will will need to permit traffic on ports 139, 137 etc  and then make exchange traffic ports static for connecting to the exchange server, but first I want to make sure I can successfully limit users traffic on the vpn.  

I can successfully limit these users to the single ip address by using the filters in Config/Policy Management/Traffic Management/Rules area with the rules below, but can't seem to limit to any one or more ports/protocols.  I tried testing by limiting the dialin user to smtp (port 25) and and testing with 'telnet 192.168.1.20 25' but whenever I choose anything other than 'any' in the protocol selection like TCP for the 'permit'/forward rule it allows no access at all.    Then I tried adding 2 more rules one with TCP and one with UDP both with port 25 in the source and destination ports, thinking I needed to permit both TCP and UDP but no success.  What are the rules I need to accomplish this?  

Rule1 and Rule2 are associated with the DialUsers filter as follows:
- <FilterRule>
  <name>Rule1</name>
  <direction>inbound</direction>
  <action>forward</action>
  <protocol>any</protocol>
  <src_ipaddr>192.168.2.0</src_ipaddr>
  <src_mask>255.255.255.255</src_mask>
  <dst_ipaddr>192.168.1.20</dst_ipaddr>
  <dst_mask>0.0.0.0</dst_mask>
  </FilterRule>

- <FilterRule>
  <name>Rule2</name>
  <direction>inbound</direction>
  <action>drop</action>
  <protocol>any</protocol>
  <src_ipaddr>0.0.0.0</src_ipaddr>
  <src_mask>255.255.255.255</src_mask>
  <dst_ipaddr>0.0.0.0</dst_ipaddr>
  <dst_mask>255.255.255.255</dst_mask>
  </FilterRule>

- <Filter>
  <name>DialUsers</name>
  <default_action>forward</default_action>
  <allow_source_route>false</allow_source_route>
  <allow_fragments>true</allow_fragments>
  <desc>Allow users only email access </desc>
- <rule_list>
  <rule>Rule1</rule>
  <sa />
  <rule>Rule2</rule>
  <sa />
  </rule_list>
  </Filter>
0
thefumbler
Asked:
thefumbler
1 Solution
 
Tim HolmanCommented:
You need an inbound rule:

Name - SMTP 192.168.1.20 In
Inbound
Forward
TCP
Don't care
Source - DialIn Users
Destination - 192.168.1.20
Source port - range  0-65535
Dst port - 25

and an outboud rule:

Name - SMTP 192.168.1.20 Out
Outbound
Forward
TCP
Don't care
Source - 192.168.1.20
Destination - DialIn Users
Source port - 25
Dst port - range 0-65535

Apply these to the filter, and hey presto, things should start kicking in.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now