How to restrict traffic between the VPN server and remote Cisco clients |
 |
EXPERT RESPONSE FROM: Mike Chapple
|
|
|
|
| > |
QUESTION POSED ON: 25 November 2006
I have recently set up a VPN tunnel between a Cisco PIX 506E (VPN server) and remote clients. Right now, the remote clients have full access to the private network, but I want them to only have access to a specific application. On the Cisco PIX there's also a site-to-site VPN tunnel setup. From what I understand, the command "sysopt connection permit-ipsec," permits IPsec traffic to pass through the PIX firewall without a check of access list command statements. Is it possible to just permit one type of traffic (protocol) to flow between the VPN server and the remote Cisco clients?
|
|
| > |
EXPERT RESPONSE
You've actually identified your issue in your question. You have the "sysopt connection permit-ipsec" command in your configuration. This automatically allows VPN traffic into the internal network without filtering. If you want to apply specific port filters to the tunnel, disable the command and apply an access control list to the appropriate PIX interface. Granted, it's not the easiest thing to configure on a PIX, but it's technically possible.
More information:
Find out the costs of maintaining a VPN.
Learn how L2TP and PPTP differ from IPsec
|
|
|
|
|
|
|
|
Search and Browse the Expert Answer Center
Search and browse more than 25,000 question and
answer pairs from more than 250 TechTarget industry experts.
|
|
|
|
|
|
|
|
|
|
|
|
