05-24-2007 05:39 AM - edited 03-11-2019 03:19 AM
Hi
I'm trying to restrict a VPN client so that it can only access one device behind our firewall. I have implemented the following commands
ip local pool SCS_Nant_Pool 10.10.99.1 mask 255.255.255.255
tunnel-group SCS_Nant_Support type ipsec-ra
tunnel-group SCS_Nant_Support general-attributes
address-pool SCS_Nant_Pool
tunnel-group SCS_Nant_Support ipsec-attributes
pre-shared-key *******
access-list nonat extended permit ip host 128.6.100.112 host 10.10.99.1
where 128.6.100.112 is the device I want sole access of. When I connect I receive IP address 10.10.99.1 OK but cannot ping or connect to 128.6.100.112. If I use a different tunnel group I can access everything fine. Command for the working group are
ip local pool Vpn-Pool 128.7.0.1-128.7.0.100 mask 255.255.0.0
tunnel-group ras type ipsec-ra
tunnel-group ras general-attributes
address-pool Vpn-Pool
tunnel-group ras ipsec-attributes
pre-shared-key ********
access-list nonat extended permit ip LOCAL_NET 255.255.0.0 CSG_WAN 255.255.255.0
access-list nonat extended permit ip LOCAL_NET 255.255.0.0 host ICCHOST
access-list nonat extended permit ip LOCAL_NET 255.255.0.0 10.0.0.0 255.252.0.0
access-list nonat extended permit ip host 128.6.100.112 CSG_WAN 255.255.255.0
access-list nonat extended permit ip host 128.6.100.112 10.0.0.0 255.255.0.0
access-list nonat remark nat 0 for remote vpn users
access-list nonat extended permit ip any 128.7.0.0 255.255.0.0
access-list nonat extended permit ip host 128.6.100.112 10.1.0.0 255.255.0.0
I have used this method before on firewalls running 6.3 without issue but this firewall (running v7) is not working.
Any help would be greatly appreciated.
Thanks
Rex
Solved! Go to Solution.
05-25-2007 08:14 AM
I forgot about that entry. I don't see an outbound ACL hole for these two hosts.
access-list inside_out extended permit tcp host TALENT_SERVER host 10.10.99.1
05-24-2007 05:54 AM
The subnet mask/network is wrong here.
access-list nonat extended permit ip host 128.6.100.112 10.0.0.0 255.255.0.0
should be 10.0.0.0 255.0.0.0 or 10.10.0.0 255.255.0.0
or change this one to 10.10.0.0
access-list nonat extended permit ip host 128.6.100.112 10.1.0.0 255.255.0.0
please rate if it helps
05-24-2007 06:36 AM
05-24-2007 06:48 AM
In what you originally posted you had no statement in your nat0 acl for the traffic in question, 128.6.100.112 to 10.10.0.0. I posted the statement to add to correct the issue. It appears you have added the following instead which is fine.
access-list nonat extended permit ip host TALENT_SERVER host 10.10.99.1
This should have done the trick.
05-24-2007 07:01 AM
I dont think I worded my original request very well, sorry for that. The config I sent is what is currently running on the Pix but I'm not getting any access.
05-24-2007 07:16 AM
Any logs on the ASA when you are trying the connection? It appears your split tunnel policy should tunnel all or tunnel your local lan so that should be ok. Nat exemption is ok, acl's aren't a problem. Make sure there is no other route to 10.10.0.0 other than ASA.
05-24-2007 07:20 AM
Have you punched a hole in the ACL bound to the inside interface?
05-24-2007 07:22 AM
^^ sysopt conn permit-ipsec takes care of that.
05-24-2007 07:28 AM
It takes care of the vpn traffic coming into the outside interface but it doesn't help the traffic initiated from the inside interface.
And your command doesn't apply to 7.x code. Its sysopt connection permit-vpn now.
05-24-2007 07:33 AM
It's only permit-vpn in 7.1 and 7.2. He's running 7.0.
And his original post was attempting to access the inside server, not trying to access the client from the server, that's why I assumed he didn't have to worry about the inside acl. Good pickup though.
05-24-2007 07:43 AM
addressing the inside ACL will restrict the traffic however you want to look at it whether its client to server or server to client.
good catch on the 7.0 version
05-24-2007 07:45 AM
I agree, I assumed it was client to server from the above...
"cannot ping or connect to 128.6.100.112"
05-25-2007 12:40 AM
It is client to server (i.e. I'm sat at the client machine with VPN connected trying to ping 128.6.100.112 on the remote network - and failing).
05-25-2007 08:03 AM
access-list nonat extended permit ip host 128.6.100.112 host 10.10.99.1
05-25-2007 08:09 AM
Palomoj,
Yes you are correct but he already has added
access-list nonat extended permit ip host TALENT_SERVER host 10.10.99.1
Shouldn't that work as well?
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: