Solved

PIX 525 that is doing NAT, ACL's and IPSec tunnels

Posted on 2004-10-07
4
654 Views
Last Modified: 2013-11-16
If the client is terminating IPSec tunnels on the  PIX.  Will traffic still need to meet ACL criteria to be passed to the
 trusted side of the PIX?  The reason that I am asking is because of the way they have their PIX configured.  This is not a
 question about setting up an IPSec tunnel as much as the flow of the traffic.  This tunnel is passing traffic.  So what I want to verify is after the tunnel has agreed upon parameters and before traffic begins to flow, will it need to pass through the access-list acl_out before going to the trusted side?  

0
Comment
Question by:mattnmilw
  • 2
  • 2
4 Comments
 

Expert Comment

by:rolltide_bama
ID: 12249216
Well i am not sure if i am reading this question right but when you permit ipsec peers or networks you add them to a seperate acl because you are normally trusting private Ip addresses. So unless your acl_out is tied to your crypto map statement then no it wouldnt go through that acl.
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 250 total points
ID: 12249787
VPN tunnels appear to the PIX as if originating within itself, not from any interface.
It should be a separate subnet
The Sysopt connection permit-ipsec command bypasses ingress access-lists
The Nat-zero access-list pretty  much determines the data flow between the inside LAN and the VPN subnet
The split-tunnel access-list determines what traffic the client actually sends down the tunnel
If you have an outbound access-list applied to the inside interface, then that will affect traffic between the inside hosts and the VPN clients.

rolltide_bama - long time no see! What do you think of Bama's chances with Croyle out for the season?
0
 

Expert Comment

by:rolltide_bama
ID: 12250045
good explanation of those commands and what they do.

hey lrmoore, yeah no long time no see for sure. As for Alabama they will be lucky to win a few more games and i dread playing Auburn.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 12250182
I'll never hear the end of it. Wife's a big Auburn fan....
"that's what you get for showing off" (52-0 in game where Croyle got hurt at the very end)
"shouldn't have had him on the field anyway, shoulda let the backup QB's get a few plays in"
on and on and on.....

Thanks for the points, Matt!
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

This article will cover setting up redundant ISPs for outbound connectivity on an ASA 5510 (although the same should work on the 5520s and up as well).  It’s important to note that this covers outbound connectivity only.  The ASA does not have built…
Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
This video discusses moving either the default database or any database to a new volume.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now