04-06-2007 05:32 AM - edited 02-21-2020 02:58 PM
Hi
I have a customer who wants to connect 4 locations with IPSEC tunnels in a full mesh using ASA 5505's. The catch is that hosts in locations A, B and C are trusted but location D is a partner location so the hosts are not fully trusted. The customer would like hosts in A, B, or C to be able to initiate connections to any host in location D but not allow hosts in location D to initiate connections to anyone in locations A, B or C.
These are all small sites so the ASAs will be the only devices available.
Does anyone have suggestions how I can accomplish this?
Thanks
04-06-2007 07:10 AM
Hi
Do you have control over site D VPN device ? If so just create an access-list denying traffic from D to A, B or C and apply in on the inside interface of site D device.
If you don't you could apply access-lists in an outboudn direction on A, B & C ASA devices denying site D traffic.
HTH
Jon
04-06-2007 07:48 AM
Thanks for the reply.
I do have control over site D.
Will that still allow the return traffic for connections initiated from sites A, B and C through?
04-08-2007 08:49 AM
Hi
Yes it will because the ASA is a stateful firewall. So traffic intiated from site D will be dropped. Traffic returning from site D in response to a connection initiated from one of the other sites will still work.
HTH
Jon
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide