VPN Termination on an interface other than "outside"

[peter.sprygada]

I have a rather perplexing situation here. I have a customer that is terminating VPN connections on a PIX520 with six interfaces. The VPN works great when terminating on the outside interface. We need to terminate a different VPN on one of the "dmz" interfaces. We are able to get the tunnel up and running just fine; however, the dynamic ACL that is being built will only allow ICMP traffic. We are currently running 5.2(2) code. Has anyone ever tried this and gotten it to work properly?? Right now we have the TAC engineers completely stumped.

[tterrance]

Sounds like a bug. Has your TAC engineer sent this to the development team?

[s.munzani]

I have done it a few times using NAT 0 commands. Keep VPN terminating outside but in your interesting traffic create access-list that address traffic from DMZ to your remote site. Also include this in NAT 0 command to bypass NAT for this traffic. With 5.2 it works great. It doesn't work with PL-COMPATIBLE.

Sam

[ozan.ocal]

Hi Peter,

I think this is an IOS issue on the FW. In order to terminate the VPN on one of the inside interfaces you may check the release notes of the IOS.

HTH