Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

VPN Client w/ a DMZ

I have a PIX 515 with 3 interfaces (inside,outsize,dmz)

When connecting using the Cisco Client VPN, I can access the inside no problem, however, I cannot access anything on the DMZ. I added the NAT 0 ACL line to include DMZ_network and the VPN_CLIENT_POOL network. I also added the split-tunnel respectively with no success. Any clues what to check? I connect to the PIX w/ the client and try to ping an IP and looking at the NAT 0 ACL, I don't see any hits on that line.

1 ACCEPTED SOLUTION

Accepted Solutions
Green

Re: VPN Client w/ a DMZ

You cannot just add the acl line to the existing nat exemption acl because the nat statement is nat ("inside") 0, not DMZ. The best thing to do is to create a second acl for the dmz nat exemption

access-list dmz_nat0_outbound permit ip

nat (DMZ) 0 access-list dmz_nat0_outbound

2 REPLIES
Green

Re: VPN Client w/ a DMZ

You cannot just add the acl line to the existing nat exemption acl because the nat statement is nat ("inside") 0, not DMZ. The best thing to do is to create a second acl for the dmz nat exemption

access-list dmz_nat0_outbound permit ip

nat (DMZ) 0 access-list dmz_nat0_outbound

New Member

Re: VPN Client w/ a DMZ

DOH! You're right. I sat there for like 20-30 minutes knowing I was overlooking something and as soon as I read "nat('inside') it clicked! Thank you!

130
Views
0
Helpful
2
Replies
CreatePlease to create content