Link to home
Start Free TrialLog in
Avatar of bbresslin
bbresslinFlag for United States of America

asked on

ASA VPN Access List Issue

I have an ASA 5510 with an access list that permits traffic to a SQL sever from a few IP sources, one being the VPN pool of addresses....I have a client who is VPN'd in from a hotel, and could not access the server?  The only way to do it was to add his source IP address to the permit list?  Since my VPN pool of addresses is permitted to this server shouldn't the source IP be one from the VPN pool?

the syslog message was Source IP 166.x.x.x Description: Deny tcp src outside.....by access group outside_access_in...

This is very strange to me why it would be denying the connection from the source outside, when he is VPN'd in...I confirmed it in the ASA, and his IP on his machine was one from the VPn pool?  Any suggestions would help...
Avatar of MikeKane
MikeKane
Flag of United States of America image

Would you post the code from the ASA if possible.  

There must be a problem between the IP pool config and the access-list somewhere.....
FYI, the reason the source is shown as outside is that whenever a VPN connection is established, it is generally coming in from the Internet, which is the outside interface. It looks weird, but that's the reason - the source is indeed on the outside interface.
Avatar of bbresslin

ASKER

The config on the ASA is massive and would take forever to scrub, but I can add some bullet points..

There is an access list on the outside interface allowing traffic from a few specific ip addresses to this particular server....A single public IP from another remote site, and the VPN pool of addresses...since "technically" the VPN pool of addresses aren't attached to the outside interface of the firewall, would the access list be blocking access to the app server on the outside since the traffic is coming from an IP address not being allowed on the outside interface?
Is the source IP 166.x.x.x part of your pool?    

Is your client vpn running a split tunnel config?   IS the traffic from the client coming across the vpn or the public net?  

Is there an access list applied to the inside interface in either direction?    Is the vpn pool on nonat?
166 is not part of the pool....VPN client is running split tunneling....traffic from client is coming across remote access VPN....VPN pool is nat exempt...
ASKER CERTIFIED SOLUTION
Avatar of MikeKane
MikeKane
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Customer is accessing via vpn, however the server is resolving to a public IP address, so it is not seeing this traffic as VPN traffic, client needed to access the server using the internal ip address rather than the name...