topic Allow local user access to remote VPN in Network Security

Allow local user access to remote VPN

Peter von Nostrand — Mon, 11 Mar 2019 21:33:48 GMT

Hello, I have a 3845 router (12.4(13r)T10) with ZBF. On my LAN there is a user who need to access a remote IPSEC VPN server. He is able to get the tunnel but afterwards he cannot connect to any service in the remote LAN. As I'm using zbf I think that I should inspect traffic from my LAN zone to EXT zone, There is a document that describe a solution to this? What IP adressess should I use? Thanks.

Allow local user access to remote VPN

Peter von Nostrand — Wed, 05 Oct 2011 20:14:31 GMT

OK, let's try again.

A user from my local LAN is trying to access a REMOTE SERVICE through a REMOTE VPN SERVER. Since I'm using a Zone Based Firewall, what would be the rules to permit first the connection to the REMOTE VPN SERVER (using IPSEC) and second allow traffic from LOCAL PC to REMOTE SERVICE.

What IP numbers should I use to the source address? Those provided by the REMOTE VPN SERVER or my LOCAL ones. Any pointers will be appreciated. Thanks.

Allow local user access to remote VPN

Maykol Rojas — Thu, 06 Oct 2011 05:13:05 GMT

Hi,

What kind of VPN are you using?

If the local PC needs to access the Remote service, it will need to connect to the IP address across the tunnel, so the remote service when replies back.

So your zone based should have a policy allowing from the local PC to the Remote service (in-zone to outside) and then another one (Out-zone to in-zone)

Make sure that the policy is located at first, so other inspections will not hit first.

Mike.

Allow local user access to remote VPN

Peter von Nostrand — Thu, 06 Oct 2011 18:17:56 GMT

Hey,

Maykol Rojas wrote:

Hi,

What kind of VPN are you using?

The local user access an IPSEC VPN on the REMOTE VPN SERVER.

If the local PC needs to access the Remote service, it will need to connect to the IP address across the tunnel, so the remote service when replies back.

So your zone based should have a policy allowing from the local PC to the Remote service (in-zone to outside) and then another one (Out-zone to in-zone)

In ZBF, returning traffic from inspected outgoing traffic is permitted, is this right? Should I allow traffic from the remote LAN although it was permited the traffic from my LAN?