Solved

PIX 525 that is doing NAT, ACL's and IPSec tunnels

Posted on 2004-10-07
4
656 Views
Last Modified: 2013-11-16
If the client is terminating IPSec tunnels on the  PIX.  Will traffic still need to meet ACL criteria to be passed to the
 trusted side of the PIX?  The reason that I am asking is because of the way they have their PIX configured.  This is not a
 question about setting up an IPSec tunnel as much as the flow of the traffic.  This tunnel is passing traffic.  So what I want to verify is after the tunnel has agreed upon parameters and before traffic begins to flow, will it need to pass through the access-list acl_out before going to the trusted side?  

0
Comment
Question by:mattnmilw
  • 2
  • 2
4 Comments
 

Expert Comment

by:rolltide_bama
ID: 12249216
Well i am not sure if i am reading this question right but when you permit ipsec peers or networks you add them to a seperate acl because you are normally trusting private Ip addresses. So unless your acl_out is tied to your crypto map statement then no it wouldnt go through that acl.
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 250 total points
ID: 12249787
VPN tunnels appear to the PIX as if originating within itself, not from any interface.
It should be a separate subnet
The Sysopt connection permit-ipsec command bypasses ingress access-lists
The Nat-zero access-list pretty  much determines the data flow between the inside LAN and the VPN subnet
The split-tunnel access-list determines what traffic the client actually sends down the tunnel
If you have an outbound access-list applied to the inside interface, then that will affect traffic between the inside hosts and the VPN clients.

rolltide_bama - long time no see! What do you think of Bama's chances with Croyle out for the season?
0
 

Expert Comment

by:rolltide_bama
ID: 12250045
good explanation of those commands and what they do.

hey lrmoore, yeah no long time no see for sure. As for Alabama they will be lucky to win a few more games and i dread playing Auburn.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 12250182
I'll never hear the end of it. Wife's a big Auburn fan....
"that's what you get for showing off" (52-0 in game where Croyle got hurt at the very end)
"shouldn't have had him on the field anyway, shoulda let the backup QB's get a few plays in"
on and on and on.....

Thanks for the points, Matt!
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Multicast on 3750x cisco router 1 39
Is this QoS Correct on this  CISCO 3825 Router 1 74
Cost effective dual wan w/ qos 5 46
Palo Alto Networks: Truly No Hit Count? 2 46
This is about downgrading PIX Version 8.0(4) & ASDM 6.1(5) to PIX 7.2(4) and ASDM 5.2(4) but with only 64MB RAM and 16MB flash. Background: You have a Cisco Pix 515E which was running on PIX 7.2(4) and its supporting ASDM 5.2(4) without any i…
This article will cover setting up redundant ISPs for outbound connectivity on an ASA 5510 (although the same should work on the 5520s and up as well).  It’s important to note that this covers outbound connectivity only.  The ASA does not have built…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

832 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question