topic Re: Access to services on the DMZ while VPN'd in in Network Security

Access to services on the DMZ while VPN'd in

moorera — Mon, 11 Mar 2019 13:56:39 GMT

I have a Cisco 5510 that has a DMZ setup on it and supports Remote Access via the legacy client, not web or SSL. While on VPN I can get to all internal resources, have no problems. However I cannot conect to any resouce in the Dmz. I've look at the Nat rules and firewall rules, however I am stumped. I think the order of operations is the VPN packet arrives at the outside interface, ACLs are checked, then decrypted, then Nat'd (if any) and the passed.

So I am assuming i need to have rules that allow the decrypted packet traverse from the Outside interface to the Dmz and back.

However I am not sure how to go about this. The address I am trying to reach in the DMZ is the actual address of the webserver and not its Nat'd address.

Thanks.

Randy

Re: Access to services on the DMZ while VPN'd in

jstabl — Mon, 13 Oct 2008 11:23:58 GMT

Can you post your config and maybe that will shed some light on it?

What type of service does the Server on DMZ supply?

Re: Access to services on the DMZ while VPN'd in

acomiskey — Mon, 13 Oct 2008 12:02:41 GMT

Most likely you are just missing nat exemption.

access-list dmz_nat0_outbound extended permit ip any

nat (dmz) 0 access-list dmz_nat0_outbound

Re: Access to services on the DMZ while VPN'd in

moorera — Mon, 13 Oct 2008 14:23:50 GMT

Thanks for the post. That is what I thought but still no joy.... WOuld you perhaps know from what interface would the PIX think this request originates from. My thought is since the traffic comes through the Outside interface, is deencrypted and then placed in the inside interface que that perhaps there is no way to bounce this traffic to the DMZ interface as it would be entering the interface (inside) to get there form where it is from. I'm thinking this is not allowed (normally isn't) and I cannot think of how to make this work..... THoughts?

Re: Access to services on the DMZ while VPN'd in

sjones1966 — Mon, 13 Oct 2008 21:33:31 GMT

If you are using a legacy client is it setup to use the default gateway on the remote network? Nothing to do with the asa itself but how the vpn is handling routing.