VPN Client w/ a DMZ

Answered Question

I have a PIX 515 with 3 interfaces (inside,outsize,dmz)


When connecting using the Cisco Client VPN, I can access the inside no problem, however, I cannot access anything on the DMZ. I added the NAT 0 ACL line to include DMZ_network and the VPN_CLIENT_POOL network. I also added the split-tunnel respectively with no success. Any clues what to check? I connect to the PIX w/ the client and try to ping an IP and looking at the NAT 0 ACL, I don't see any hits on that line.


Correct Answer by acomiskey about 10 years 3 months ago

You cannot just add the acl line to the existing nat exemption acl because the nat statement is nat ("inside") 0, not DMZ. The best thing to do is to create a second acl for the dmz nat exemption


access-list dmz_nat0_outbound permit ip

nat (DMZ) 0 access-list dmz_nat0_outbound


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
acomiskey Mon, 04/16/2007 - 12:37
User Badges:
  • Green, 3000 points or more

You cannot just add the acl line to the existing nat exemption acl because the nat statement is nat ("inside") 0, not DMZ. The best thing to do is to create a second acl for the dmz nat exemption


access-list dmz_nat0_outbound permit ip

nat (DMZ) 0 access-list dmz_nat0_outbound


Actions

This Discussion