Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Trouble restricting client VPN access

Hi

I'm trying to restrict a VPN client so that it can only access one device behind our firewall. I have implemented the following commands

ip local pool SCS_Nant_Pool 10.10.99.1 mask 255.255.255.255

tunnel-group SCS_Nant_Support type ipsec-ra

tunnel-group SCS_Nant_Support general-attributes

address-pool SCS_Nant_Pool

tunnel-group SCS_Nant_Support ipsec-attributes

pre-shared-key *******

access-list nonat extended permit ip host 128.6.100.112 host 10.10.99.1

where 128.6.100.112 is the device I want sole access of. When I connect I receive IP address 10.10.99.1 OK but cannot ping or connect to 128.6.100.112. If I use a different tunnel group I can access everything fine. Command for the working group are

ip local pool Vpn-Pool 128.7.0.1-128.7.0.100 mask 255.255.0.0

tunnel-group ras type ipsec-ra

tunnel-group ras general-attributes

address-pool Vpn-Pool

tunnel-group ras ipsec-attributes

pre-shared-key ********

access-list nonat extended permit ip LOCAL_NET 255.255.0.0 CSG_WAN 255.255.255.0

access-list nonat extended permit ip LOCAL_NET 255.255.0.0 host ICCHOST

access-list nonat extended permit ip LOCAL_NET 255.255.0.0 10.0.0.0 255.252.0.0

access-list nonat extended permit ip host 128.6.100.112 CSG_WAN 255.255.255.0

access-list nonat extended permit ip host 128.6.100.112 10.0.0.0 255.255.0.0

access-list nonat remark nat 0 for remote vpn users

access-list nonat extended permit ip any 128.7.0.0 255.255.0.0

access-list nonat extended permit ip host 128.6.100.112 10.1.0.0 255.255.0.0

I have used this method before on firewalls running 6.3 without issue but this firewall (running v7) is not working.

Any help would be greatly appreciated.

Thanks

Rex

1 ACCEPTED SOLUTION

Accepted Solutions
New Member

Re: Trouble restricting client VPN access

I forgot about that entry. I don't see an outbound ACL hole for these two hosts.

access-list inside_out extended permit tcp host TALENT_SERVER host 10.10.99.1

26 REPLIES
Green

Re: Trouble restricting client VPN access

The subnet mask/network is wrong here.

access-list nonat extended permit ip host 128.6.100.112 10.0.0.0 255.255.0.0

should be 10.0.0.0 255.0.0.0 or 10.10.0.0 255.255.0.0

or change this one to 10.10.0.0

access-list nonat extended permit ip host 128.6.100.112 10.1.0.0 255.255.0.0

please rate if it helps

New Member

Re: Trouble restricting client VPN access

Thanks for the reply. I removed that line completely as it doesn't relate to anything I'm doing but it's made no difference. I've attached my config if it helps.

Green

Re: Trouble restricting client VPN access

In what you originally posted you had no statement in your nat0 acl for the traffic in question, 128.6.100.112 to 10.10.0.0. I posted the statement to add to correct the issue. It appears you have added the following instead which is fine.

access-list nonat extended permit ip host TALENT_SERVER host 10.10.99.1

This should have done the trick.

New Member

Re: Trouble restricting client VPN access

I dont think I worded my original request very well, sorry for that. The config I sent is what is currently running on the Pix but I'm not getting any access.

Green

Re: Trouble restricting client VPN access

Any logs on the ASA when you are trying the connection? It appears your split tunnel policy should tunnel all or tunnel your local lan so that should be ok. Nat exemption is ok, acl's aren't a problem. Make sure there is no other route to 10.10.0.0 other than ASA.

New Member

Re: Trouble restricting client VPN access

Have you punched a hole in the ACL bound to the inside interface?

Green

Re: Trouble restricting client VPN access

^^ sysopt conn permit-ipsec takes care of that.

New Member

Re: Trouble restricting client VPN access

It takes care of the vpn traffic coming into the outside interface but it doesn't help the traffic initiated from the inside interface.

And your command doesn't apply to 7.x code. Its sysopt connection permit-vpn now.

Green

Re: Trouble restricting client VPN access

It's only permit-vpn in 7.1 and 7.2. He's running 7.0.

And his original post was attempting to access the inside server, not trying to access the client from the server, that's why I assumed he didn't have to worry about the inside acl. Good pickup though.

New Member

Re: Trouble restricting client VPN access

addressing the inside ACL will restrict the traffic however you want to look at it whether its client to server or server to client.

good catch on the 7.0 version

Green

Re: Trouble restricting client VPN access

I agree, I assumed it was client to server from the above...

"cannot ping or connect to 128.6.100.112"

New Member

Re: Trouble restricting client VPN access

It is client to server (i.e. I'm sat at the client machine with VPN connected trying to ping 128.6.100.112 on the remote network - and failing).

New Member

Re: Trouble restricting client VPN access

access-list nonat extended permit ip host 128.6.100.112 host 10.10.99.1

Green

Re: Trouble restricting client VPN access

Palomoj,

Yes you are correct but he already has added

access-list nonat extended permit ip host TALENT_SERVER host 10.10.99.1

Shouldn't that work as well?

New Member

Re: Trouble restricting client VPN access

I forgot about that entry. I don't see an outbound ACL hole for these two hosts.

access-list inside_out extended permit tcp host TALENT_SERVER host 10.10.99.1

New Member

Re: Trouble restricting client VPN access

Thanks for all your help. I took your advice and added the line

access-list inside_out extended permit ip host TALENT_SERVER host 10.10.99.1

and all is working fine now.

Green

Re: Trouble restricting client VPN access

palomoj, I still don't get why this worked as he was initiating traffic from the remote end. The sysopt command would allow this traffic back out without the need for the acl right?

New Member

Re: Trouble restricting client VPN access

The sysopt will permit the remote client vpn traffic to terminate and enter the outside interface without an outside ACL explicitly or implicitly permitting the traffic.

The inside ACL was denying the return (and initiating) traffic from the inside host to the remote VPN client.

HTH

Green

Re: Trouble restricting client VPN access

Weird, I understand the initiating from the inside problem, but I could have sworn that the traffic bypassed all interface acl's, inside and outside.

When blocking the return traffic the firwall is basically not stateful anymore? If I accessed a webserver from the outside and had an inside access-list I would not have to have the return traffic permitted...I know you know this, just using it as an example.

access-list inside permit tcp webserver eq 80 any

New Member

Re: Trouble restricting client VPN access

Its still stateful and always will be but an inside ACL blocking the outbound traffic results in blocked traffic. Here's a good explanation of the EXACT operations of the ASA.

1. A TCP SYN packet arrives at the PIX Firewall to establish a new connection.

2. The PIX Firewall checks the access control list (ACL) database to determine if the connection is permitted.

3. The PIX Firewall creates a new entry in the connection database (XLATE and CONN tables).

4. The PIX Firewall checks the Inspections database to determine if the connection requires application-level inspection.

5. After the application inspection function completes any required operations for the packet, the PIX Firewall forwards the packet to the destination system.

6. The destination system responds to the initial request.

7. The PIX Firewall receives the reply packet, looks up the connection in the connection database, and forwards the packet because it belongs to an established session.

Here's a link.

http://www.cisco.com/en/US/docs/security/pix/pix63/configuration/guide/fixup.html#wp1078381

Green

Re: Trouble restricting client VPN access

Exactly, if the communication was initiated from the outside the conn would be built and the reply would be allowed, regardless of an inside acl.

I understand he would not be able to initiate from the inside, but this is not what he was trying to do. He was initiating traffic from the vpn client, which would have built the connection in the firewall and using the above, #7 would allow the reply to the vpn client in the inside interface, right or wrong?

New Member

Re: Trouble restricting client VPN access

I think you're getting confused with the interface where the return traffic is entering. If the inside acl permits the outbound traffic, the ASA will allow the return traffic from the outside even if the outside ACL has a deny ip any any in it. If the traffic is permitted from the outside but the inside acl does not permit the return traffic, then you will not have a connection built.

Green

Re: Trouble restricting client VPN access

"I think you're getting confused with the interface where the return traffic is entering"

-Nope. It depends on who is initiating the connection. If initiated from outside then the return traffic would be into inside interface and vice versa.

"If the inside acl permits the outbound traffic, the ASA will allow the return traffic from the outside even if the outside ACL has a deny ip any any in it."

-Yes, I understand that.

If the traffic is permitted from the outside but the inside acl does not permit the return traffic, then you will not have a connection built.

-Why? Isn't that what stateful is all about? If what you are saying is true then to hit a webserver on the inside from the outside I would need this...

access-list outside permit tcp any host webserver eq 80

access-group outside in interface outside

and...

access-list inside permit tcp webserver eq 80 any

access-group inside in interface inside

New Member

Re: Trouble restricting client VPN access

well by default there is no inside acl so normally it would permitted if the outside acl permits and there is a static nat entry.

what's your email address? so we can take this offline.

Green

Re: Trouble restricting client VPN access

Emailing you...

New Member

Re: Trouble restricting client VPN access

The only comments I've added are those listed at the beginning of my first post. However, my colleague (god bless him) may have. I think he tried to sort this out himself before enlisting my help (without any knowledge of Pix's). Alas I cannot contact him at the moment.

167
Views
0
Helpful
26
Replies
CreatePlease to create content