topic Re: VPN Client w/ a DMZ in Network Security https://community.cisco.com/t5/network-security/vpn-client-w-a-dmz/m-p/745045#M1054181 <HTML><HEAD></HEAD><BODY><P>You cannot just add the acl line to the existing nat exemption acl because the nat statement is nat ("inside") 0, not DMZ. The best thing to do is to create a second acl for the dmz nat exemption</P><P></P><P>access-list dmz_nat0_outbound permit ip <DMZ_NETWORK> <MASK> <VPNCLIENT_NETWORK> <MASK></MASK></VPNCLIENT_NETWORK></MASK></DMZ_NETWORK></P><P>nat (DMZ) 0 access-list dmz_nat0_outbound</P><P></P></BODY></HTML> Mon, 16 Apr 2007 19:37:43 GMT acomiskey 2007-04-16T19:37:43Z VPN Client w/ a DMZ https://community.cisco.com/t5/network-security/vpn-client-w-a-dmz/m-p/745044#M1054174 <P>I have a PIX 515 with 3 interfaces (inside,outsize,dmz)</P><P></P><P>When connecting using the Cisco Client VPN, I can access the inside no problem, however, I cannot access anything on the DMZ. I added the NAT 0 ACL line to include DMZ_network and the VPN_CLIENT_POOL network. I also added the split-tunnel respectively with no success. Any clues what to check? I connect to the PIX w/ the client and try to ping an IP and looking at the NAT 0 ACL, I don't see any hits on that line.</P><P></P> Fri, 21 Feb 2020 09:29:15 GMT https://community.cisco.com/t5/network-security/vpn-client-w-a-dmz/m-p/745044#M1054174 jfinley 2020-02-21T09:29:15Z Re: VPN Client w/ a DMZ https://community.cisco.com/t5/network-security/vpn-client-w-a-dmz/m-p/745045#M1054181 <HTML><HEAD></HEAD><BODY><P>You cannot just add the acl line to the existing nat exemption acl because the nat statement is nat ("inside") 0, not DMZ. The best thing to do is to create a second acl for the dmz nat exemption</P><P></P><P>access-list dmz_nat0_outbound permit ip <DMZ_NETWORK> <MASK> <VPNCLIENT_NETWORK> <MASK></MASK></VPNCLIENT_NETWORK></MASK></DMZ_NETWORK></P><P>nat (DMZ) 0 access-list dmz_nat0_outbound</P><P></P></BODY></HTML> Mon, 16 Apr 2007 19:37:43 GMT https://community.cisco.com/t5/network-security/vpn-client-w-a-dmz/m-p/745045#M1054181 acomiskey 2007-04-16T19:37:43Z Re: VPN Client w/ a DMZ https://community.cisco.com/t5/network-security/vpn-client-w-a-dmz/m-p/745046#M1054184 <HTML><HEAD></HEAD><BODY><P>DOH! You're right. I sat there for like 20-30 minutes knowing I was overlooking something and as soon as I read "nat('inside') it clicked! Thank you!</P><P></P><P></P></BODY></HTML> Mon, 16 Apr 2007 19:52:35 GMT https://community.cisco.com/t5/network-security/vpn-client-w-a-dmz/m-p/745046#M1054184 jfinley 2007-04-16T19:52:35Z