topic Re: Remote VPN access to DMZ in Network Security https://community.cisco.com/t5/network-security/remote-vpn-access-to-dmz/m-p/976417#M916633 <HTML><HEAD></HEAD><BODY><P>Hello,</P><P>please see the attachment.</P><P></P><P>There is a entry in the root table when a RA-VPN connection is established.</P><P></P><P>But no traffic will flow form DMZ to VPN Client.</P><P></P><P>Thanks </P><P>Peter</P><P></P><P></P></BODY></HTML> Mon, 21 Jul 2008 10:30:06 GMT peterblersch 2008-07-21T10:30:06Z Remote VPN access to DMZ https://community.cisco.com/t5/network-security/remote-vpn-access-to-dmz/m-p/976413#M916626 <P>Hello,</P><P>user connecting with the VPN Client to my ASA 5510 could access ressources in the internal Network 192.168.115.0.</P><P>But there is no access through the ipsec tunnel to the DMZ Network 192.168.116.0.</P><P>VPN clients get Addresses from 192.168.113.0.</P><P></P><P>There is no NAT-relation between the internal and the DMZ, the traffic is routed. I can access ressources between DMZ and internal without problems initiated in both directions.</P><P></P><P>What could be the reason for the denied access to the DMZ from the VPN clients?</P><P></P><P>Thank you for your ideas,</P><P></P><P>Peter</P><P></P> Mon, 11 Mar 2019 13:15:13 GMT https://community.cisco.com/t5/network-security/remote-vpn-access-to-dmz/m-p/976413#M916626 peterblersch 2019-03-11T13:15:13Z Re: Remote VPN access to DMZ https://community.cisco.com/t5/network-security/remote-vpn-access-to-dmz/m-p/976414#M916630 <HTML><HEAD></HEAD><BODY><P>do you have something like the following:</P><P>nat (dmz) 0 access-list nat0dmz_acl</P><P>...where nat0dmz_acl defines traffic from your dmz to 192.168.113.0/24?</P><P>also, if yo'ure using split tunneling, make sure it's included there.</P></BODY></HTML> Wed, 16 Jul 2008 09:57:36 GMT https://community.cisco.com/t5/network-security/remote-vpn-access-to-dmz/m-p/976414#M916630 srue 2008-07-16T09:57:36Z Re: Remote VPN access to DMZ https://community.cisco.com/t5/network-security/remote-vpn-access-to-dmz/m-p/976415#M916631 <HTML><HEAD></HEAD><BODY><P>Hello srue,</P><P></P><P>there is no Nat rule between the DMZ and the</P><P>External Interface.</P><P>In the packet trace i see that packet from hosts in the DMZ route traffic to VPN LAN 192.168.113.0/24 send the packet to the default route, that is the external interface.</P><P></P><P>I will configure a static route with the virtual interface of the VPN tunnel endpoint 192.168.113.254</P><P></P><P>I suppose:</P><P>The traffic back from DMZ to VPN-LAN is not </P><P>sent to the tunnel gateway.</P><P></P><P>Thank you,</P><P></P><P>Peter</P></BODY></HTML> Fri, 18 Jul 2008 06:00:50 GMT https://community.cisco.com/t5/network-security/remote-vpn-access-to-dmz/m-p/976415#M916631 peterblersch 2008-07-18T06:00:50Z Re: Remote VPN access to DMZ https://community.cisco.com/t5/network-security/remote-vpn-access-to-dmz/m-p/976416#M916632 <HTML><HEAD></HEAD><BODY><P>show the configuration of the ASA</P></BODY></HTML> Fri, 18 Jul 2008 08:59:17 GMT https://community.cisco.com/t5/network-security/remote-vpn-access-to-dmz/m-p/976416#M916632 a.alekseev 2008-07-18T08:59:17Z Re: Remote VPN access to DMZ https://community.cisco.com/t5/network-security/remote-vpn-access-to-dmz/m-p/976417#M916633 <HTML><HEAD></HEAD><BODY><P>Hello,</P><P>please see the attachment.</P><P></P><P>There is a entry in the root table when a RA-VPN connection is established.</P><P></P><P>But no traffic will flow form DMZ to VPN Client.</P><P></P><P>Thanks </P><P>Peter</P><P></P><P></P></BODY></HTML> Mon, 21 Jul 2008 10:30:06 GMT https://community.cisco.com/t5/network-security/remote-vpn-access-to-dmz/m-p/976417#M916633 peterblersch 2008-07-21T10:30:06Z Re: Remote VPN access to DMZ https://community.cisco.com/t5/network-security/remote-vpn-access-to-dmz/m-p/976418#M916634 <HTML><HEAD></HEAD><BODY><P>access-list NO-NAT-DMZ permit ip 192.168.111.0 255.255.255.0 192.168.113.0 255.255.255.0</P><P>nat (DMZ) 0 access-list NO-NAT-DMZ</P></BODY></HTML> Mon, 21 Jul 2008 10:54:48 GMT https://community.cisco.com/t5/network-security/remote-vpn-access-to-dmz/m-p/976418#M916634 a.alekseev 2008-07-21T10:54:48Z Re: Remote VPN access to DMZ https://community.cisco.com/t5/network-security/remote-vpn-access-to-dmz/m-p/976419#M916635 <HTML><HEAD></HEAD><BODY><P>OK, it works, </P><P>thank you for the solution!</P><P></P><P>Peter</P></BODY></HTML> Tue, 22 Jul 2008 05:38:45 GMT https://community.cisco.com/t5/network-security/remote-vpn-access-to-dmz/m-p/976419#M916635 peterblersch 2008-07-22T05:38:45Z Re: Remote VPN access to DMZ https://community.cisco.com/t5/network-security/remote-vpn-access-to-dmz/m-p/976420#M916636 <HTML><HEAD></HEAD><BODY><P>Great!</P><P></P><P>[Pls RATE if HELPS] </P></BODY></HTML> Tue, 22 Jul 2008 05:41:30 GMT https://community.cisco.com/t5/network-security/remote-vpn-access-to-dmz/m-p/976420#M916636 a.alekseev 2008-07-22T05:41:30Z