Re: VPN/DMZ problem

["Christopher J. Wargaski" <wargo1 () gmail com>]

Hey Ian--

   Are you using split-tunneling with the VPN? If so, make sure that the ACL
permits the DMZ.

On Tue, Sep 2, 2008 at 5:06 AM, Ian Rarity <Ian.Rarity () espc com> wrote:

> Hi,
>
> We're having a problem with our VPN; we have a PIX 515E with 4
> interfaces:
>
> Inside (security100) - Our internal LAN, 150.150.10.0/24
> Outside (security0) - The Internet
> Perimeter (security50) - DMZ, 172.16.1.0/24
> Innerperimeter (security75) - "Inner" DMZ, 150.150.11.0/24
>
> The VPN is a certificate/token-based set up, with VPN users being
> assigned addresses from 150.150.62.0/24 (don't ask me about the weird
> addressing scheme; it was like that when I got here).
>
> The problem we're having is that VPN users can't access hosts in either
> of the DMZs, although they can see LAN hosts just fine.  I'm assuming
> that this is because the VPN traffic is coming in through the PIX's
> "outside" interface, and the usual rule about traffic from interfaces
> with a lower security level going to an interface with a higher one is
> applying.
>
> I've tried to override this with another access list, by "nat 0"-ing
> the two DMZ interfaces, but external VPN users still can't see hosts in
> the DMZs.  Obviously I'm screwing up somewhere, but I'd be very grateful
> if someone could tell me how.
>
> Ta,
> IR.
>
>
> *******************************************************************
> Private and Confidential:  This e-mail transmission is strictly
> confidential and intended solely for the addressee.  It may contain
> privileged and confidential information and if you are not the
> intended recipient, you must not copy, disclose, distribute or
> take any action in reliance on it. If you have received this
> e-mail in error, please delete it and notify our E-mail Systems
> Administrator on +44 (0) 131 624 8000. ESPC (UK) Ltd does not
> accept any liability for any harm that may be caused to the
> recipient's system or data by this message or any attachment.
>
> ESPC (UK) Ltd is a company registered under the Companies
> Acts in Scotland (Registered Number SC203535), and having its
> registered office at 90A George Street, Edinburgh, Midlothian
> EH2 3DF.
>
> ESPC (UK) Limited is authorised and regulated by the Financial
> Services Authority.
> _______________________________________________
> firewall-wizards mailing list
> firewall-wizards () listserv icsalabs com
> https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
_______________________________________________
firewall-wizards mailing list
firewall-wizards () listserv icsalabs com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards