How to allow connections in one direction over IPSEC tunnel

Unanswered Question
Apr 6th, 2007

Hi


I have a customer who wants to connect 4 locations with IPSEC tunnels in a full mesh using ASA 5505's. The catch is that hosts in locations A, B and C are trusted but location D is a partner location so the hosts are not fully trusted. The customer would like hosts in A, B, or C to be able to initiate connections to any host in location D but not allow hosts in location D to initiate connections to anyone in locations A, B or C.


These are all small sites so the ASAs will be the only devices available.


Does anyone have suggestions how I can accomplish this?


Thanks

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Jon Marshall Fri, 04/06/2007 - 07:10

Hi


Do you have control over site D VPN device ? If so just create an access-list denying traffic from D to A, B or C and apply in on the inside interface of site D device.


If you don't you could apply access-lists in an outboudn direction on A, B & C ASA devices denying site D traffic.


HTH


Jon

kseraphine Fri, 04/06/2007 - 07:48

Thanks for the reply.


I do have control over site D.


Will that still allow the return traffic for connections initiated from sites A, B and C through?

Jon Marshall Sun, 04/08/2007 - 08:49

Hi


Yes it will because the ASA is a stateful firewall. So traffic intiated from site D will be dropped. Traffic returning from site D in response to a connection initiated from one of the other sites will still work.


HTH


Jon

Actions

This Discussion