Solved

cisco vpn filter rules for limiting traffic

Posted on 2004-04-09
1
568 Views
Last Modified: 2008-02-01
I have a vpn3005 and I need to limit a group of dialin users (ip's 192.168.2.0) who use the Cisco vpn software client to ONLY access one server (192.168.1.20) in the vpn network and ONLY email traffic to that exchange server.  I know I will will need to permit traffic on ports 139, 137 etc  and then make exchange traffic ports static for connecting to the exchange server, but first I want to make sure I can successfully limit users traffic on the vpn.  

I can successfully limit these users to the single ip address by using the filters in Config/Policy Management/Traffic Management/Rules area with the rules below, but can't seem to limit to any one or more ports/protocols.  I tried testing by limiting the dialin user to smtp (port 25) and and testing with 'telnet 192.168.1.20 25' but whenever I choose anything other than 'any' in the protocol selection like TCP for the 'permit'/forward rule it allows no access at all.    Then I tried adding 2 more rules one with TCP and one with UDP both with port 25 in the source and destination ports, thinking I needed to permit both TCP and UDP but no success.  What are the rules I need to accomplish this?  

Rule1 and Rule2 are associated with the DialUsers filter as follows:
- <FilterRule>
  <name>Rule1</name>
  <direction>inbound</direction>
  <action>forward</action>
  <protocol>any</protocol>
  <src_ipaddr>192.168.2.0</src_ipaddr>
  <src_mask>255.255.255.255</src_mask>
  <dst_ipaddr>192.168.1.20</dst_ipaddr>
  <dst_mask>0.0.0.0</dst_mask>
  </FilterRule>

- <FilterRule>
  <name>Rule2</name>
  <direction>inbound</direction>
  <action>drop</action>
  <protocol>any</protocol>
  <src_ipaddr>0.0.0.0</src_ipaddr>
  <src_mask>255.255.255.255</src_mask>
  <dst_ipaddr>0.0.0.0</dst_ipaddr>
  <dst_mask>255.255.255.255</dst_mask>
  </FilterRule>

- <Filter>
  <name>DialUsers</name>
  <default_action>forward</default_action>
  <allow_source_route>false</allow_source_route>
  <allow_fragments>true</allow_fragments>
  <desc>Allow users only email access </desc>
- <rule_list>
  <rule>Rule1</rule>
  <sa />
  <rule>Rule2</rule>
  <sa />
  </rule_list>
  </Filter>
0
Comment
Question by:thefumbler
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 23

Accepted Solution

by:
Tim Holman earned 500 total points
ID: 10868033
You need an inbound rule:

Name - SMTP 192.168.1.20 In
Inbound
Forward
TCP
Don't care
Source - DialIn Users
Destination - 192.168.1.20
Source port - range  0-65535
Dst port - 25

and an outboud rule:

Name - SMTP 192.168.1.20 Out
Outbound
Forward
TCP
Don't care
Source - 192.168.1.20
Destination - DialIn Users
Source port - 25
Dst port - range 0-65535

Apply these to the filter, and hey presto, things should start kicking in.
0

Featured Post

Create the perfect environment for any meeting

You might have a modern environment with all sorts of high-tech equipment, but what makes it worthwhile is how you seamlessly bring together the presentation with audio, video and lighting. The ATEN Control System provides integrated control and system automation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I've had to do a bit of research to setup my VPN connection so that Clients can access Windows Server 2008 network shares.  I have a Cisco ASA 5510 firewall.  I found an article which was extremely useful: It had a solution if you use ASDM to config…
Some of you may have heard that SonicWALL has finally released an app for iOS devices giving us long awaited connectivity for our iPhone's, iPod's, and iPad's. This guide is just a quick rundown on how to get up and running quickly using the app. …
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
Suggested Courses

630 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question