pix/vpn3000 pair "folded" traffic

[skiergaard]

I'm pretty sure i already know the answer to this but here goes.

i have a pix and a vpn3000 unit in parallel. traffic passes as expected EXCEPT when a system inside the perimeter attempts to use a webvpn service on the outside interface of the concentrator. then traffic seems to simply vanish.

as i recall, this is fact of life as the PIX will not allow that traffic out when it hears it on both sides, correct?

if anyone knows of a trick, i would be grateful

[s.jankowski]

By default pix firewall denies all the traffic . If traffic has to be passed through it then special permissions has to be given.Pix uses a atateful firewalling technique where it keeps an account of the traffic which is passed through it .If the sam traffic comes back it will allow it in else, it will simply drop