Solved

PIX 525 that is doing NAT, ACL's and IPSec tunnels

Posted on 2004-10-07
4
657 Views
Last Modified: 2013-11-16
If the client is terminating IPSec tunnels on the  PIX.  Will traffic still need to meet ACL criteria to be passed to the
 trusted side of the PIX?  The reason that I am asking is because of the way they have their PIX configured.  This is not a
 question about setting up an IPSec tunnel as much as the flow of the traffic.  This tunnel is passing traffic.  So what I want to verify is after the tunnel has agreed upon parameters and before traffic begins to flow, will it need to pass through the access-list acl_out before going to the trusted side?  

0
Comment
Question by:mattnmilw
  • 2
  • 2
4 Comments
 

Expert Comment

by:rolltide_bama
ID: 12249216
Well i am not sure if i am reading this question right but when you permit ipsec peers or networks you add them to a seperate acl because you are normally trusting private Ip addresses. So unless your acl_out is tied to your crypto map statement then no it wouldnt go through that acl.
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 250 total points
ID: 12249787
VPN tunnels appear to the PIX as if originating within itself, not from any interface.
It should be a separate subnet
The Sysopt connection permit-ipsec command bypasses ingress access-lists
The Nat-zero access-list pretty  much determines the data flow between the inside LAN and the VPN subnet
The split-tunnel access-list determines what traffic the client actually sends down the tunnel
If you have an outbound access-list applied to the inside interface, then that will affect traffic between the inside hosts and the VPN clients.

rolltide_bama - long time no see! What do you think of Bama's chances with Croyle out for the season?
0
 

Expert Comment

by:rolltide_bama
ID: 12250045
good explanation of those commands and what they do.

hey lrmoore, yeah no long time no see for sure. As for Alabama they will be lucky to win a few more games and i dread playing Auburn.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 12250182
I'll never hear the end of it. Wife's a big Auburn fan....
"that's what you get for showing off" (52-0 in game where Croyle got hurt at the very end)
"shouldn't have had him on the field anyway, shoulda let the backup QB's get a few plays in"
on and on and on.....

Thanks for the points, Matt!
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This is about downgrading PIX Version 8.0(4) & ASDM 6.1(5) to PIX 7.2(4) and ASDM 5.2(4) but with only 64MB RAM and 16MB flash. Background: You have a Cisco Pix 515E which was running on PIX 7.2(4) and its supporting ASDM 5.2(4) without any i…
Overview The Cisco PIX 501, PIX 506e, ASA 5505 and ASA 5510 (most if not all of this information will be relevant to the PIX 515e but I do not have a working configuration handy to verify the validity) are primarily used within small to medium busi…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

820 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question