L2L IPSEC and Dynamic VPN Clients PIX 8.x

Unanswered Question

Hi,

Hope someone can help. I have a PIX setup for several fixed L2L IPSEC VPNs and also allowed Cisco VPN clients to VPN in. I have found that if traffic on one of the fixed VPNs doesnt match its access list it fires up a connection using the dynamic map rather than just dropping the traffic.

crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto ipsec transform-set set2 esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map dynmap 10 set transform-set myset
crypto dynamic-map dynmap 10 set security-association lifetime seconds 28800
crypto dynamic-map dynmap 10 set security-association lifetime kilobytes 4608000
crypto map mymap 10 set security-association lifetime seconds 28800
crypto map mymap 10 set security-association lifetime kilobytes 4608000
crypto map mymap 20 match address a1
crypto map mymap 20 set peer x.x.x.1
crypto map mymap 20 set transform-set myset
crypto map mymap 20 set security-association lifetime seconds 28800
crypto map mymap 20 set security-association lifetime kilobytes 4608000
crypto map mymap 30 set security-association lifetime seconds 28800
crypto map mymap 30 set security-association lifetime kilobytes 4608000
crypto map mymap 40 match address a2

crypto map mymap 40 set peer x.x.x.2
crypto map mymap 40 set transform-set set2
crypto map mymap 40 set security-association lifetime seconds 28800
crypto map mymap 40 set security-association lifetime kilobytes 4608000
crypto map mymap 40 set nat-t-disable
crypto map mymap 60000 ipsec-isakmp dynamic dynmap
crypto map mymap interface outside

access-list a2 extended permit tcp host 10.0.3.99 192.168.6.0 255.255.254.0
access-list a2 extended permit tcp host 10.0.3.100 192.168.6.0 255.255.254.0

any idea as to why that would happen?

thanks.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Federico Coto F... Thu, 02/25/2010 - 08:39

Hi,

When a VPN request connection comes to the PIX, the PIX will attempt to match it against the policies in sequential order.

If it does not find a match on the specific crypto map for the peer, it will continue and find a match on the dynamic crypto map for the VPN clients, since it will accept any policies with any interesting traffic (unless restricted).

To fix this, the best is to ensure that all the fixed L2L tunnels terminated on the PIX have the ACLs for interesting traffic defined exactly the samee  way on both ends of the tunnel.

Federico.

Federico Coto F... Thu, 02/25/2010 - 09:46

That is correct.

If you do not have control over the other end, you can apply an ACL to the dynamic crypto map.

In this case, since you have control on both sides, there's no need for that.

Federico.

Federico Coto F... Thu, 02/25/2010 - 09:56

Under the dynamic crypto map, you have the option to specify an ACL as with the static crypto maps:

For example:

You create the ACL named acl-name and apply it to the dynamic crypto map:

crypto dynamic-map dynmap 10 set transform-set myset
crypto dynamic-map dynmap 10 set reverse-route

crypto dynamic-map dynmap 10  match address acl-name

Federico.

Federico Coto F... Thu, 02/25/2010 - 10:05

Yes,

The remote VPN clients will have a local ident 0.0.0.0 because you can't know before hand where all the VPN clients are going to come from.

So, there's no point in restricting the IP addresses from where the remote VPN client connections can be established (unless you want to do it like this).

For ths L2L VPNs, need to make sure the interesting traffic is a mirror from the other end, in this way only the traffic specified would make it through the tunnel.

You can differentiate the internal access that has each L2L and remote VPN client connection.

So, if somebody is coming from a L2L peer VPN, it would only have access to the resources specified in the ACL for that VPN.

If somebody comes from that IP, but using the VPN client software, then will match against the dynamic crypto map.

Federico.

Actions

This Discussion