Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

PIX 525 that is doing NAT, ACL's and IPSec tunnels

Posted on 2004-10-07
4
Medium Priority
?
661 Views
Last Modified: 2013-11-16
If the client is terminating IPSec tunnels on the  PIX.  Will traffic still need to meet ACL criteria to be passed to the
 trusted side of the PIX?  The reason that I am asking is because of the way they have their PIX configured.  This is not a
 question about setting up an IPSec tunnel as much as the flow of the traffic.  This tunnel is passing traffic.  So what I want to verify is after the tunnel has agreed upon parameters and before traffic begins to flow, will it need to pass through the access-list acl_out before going to the trusted side?  

0
Comment
Question by:mattnmilw
  • 2
  • 2
4 Comments
 

Expert Comment

by:rolltide_bama
ID: 12249216
Well i am not sure if i am reading this question right but when you permit ipsec peers or networks you add them to a seperate acl because you are normally trusting private Ip addresses. So unless your acl_out is tied to your crypto map statement then no it wouldnt go through that acl.
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 1000 total points
ID: 12249787
VPN tunnels appear to the PIX as if originating within itself, not from any interface.
It should be a separate subnet
The Sysopt connection permit-ipsec command bypasses ingress access-lists
The Nat-zero access-list pretty  much determines the data flow between the inside LAN and the VPN subnet
The split-tunnel access-list determines what traffic the client actually sends down the tunnel
If you have an outbound access-list applied to the inside interface, then that will affect traffic between the inside hosts and the VPN clients.

rolltide_bama - long time no see! What do you think of Bama's chances with Croyle out for the season?
0
 

Expert Comment

by:rolltide_bama
ID: 12250045
good explanation of those commands and what they do.

hey lrmoore, yeah no long time no see for sure. As for Alabama they will be lucky to win a few more games and i dread playing Auburn.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 12250182
I'll never hear the end of it. Wife's a big Auburn fan....
"that's what you get for showing off" (52-0 in game where Croyle got hurt at the very end)
"shouldn't have had him on the field anyway, shoulda let the backup QB's get a few plays in"
on and on and on.....

Thanks for the points, Matt!
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Many of the companies I’ve worked with have embraced cloud solutions due to their desire to “get out of the datacenter business.” The ability to achieve better security and availability, and the speed with which they are able to deploy, is far grea…
There’s a movement in Information Technology (IT), and while it’s hard to define, it is gaining momentum. Some call it “stream-lined IT;” others call it “thin-model IT.”
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
When cloud platforms entered the scene, users and companies jumped on board to take advantage of the many benefits, like the ability to work and connect with company information from various locations. What many didn't foresee was the increased risk…
Suggested Courses

927 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question