topic Filtering Tunnels in Network Security

Filtering Tunnels

chrish — Mon, 11 Mar 2019 10:16:03 GMT

I have an ASA 5520 7.2 (I bleieve)

I am allowing an Ipsec tunnel thru this firewall, but the ASA itself is not an endpoint for this tunnel. Is it possible to filter the traffic that goes thru the tunnel and if so how?

All I really want to do is limit the devices allowed to use this tunnel ie allow IP 1 to IP 2 and drop everything else.

Thanks in advance.

Re: Filtering Tunnels

acomiskey — Thu, 17 May 2007 15:09:26 GMT

Could you explain, is the vpn client inside or outside the firewall? What is the endpoint? As long as you don't want to filter traffic once the tunnel is established you should be able write a simple access-list to restrict which ip addresses are able to vpn. Also, is this remote access or lan to lan?

Re: Filtering Tunnels

chrish — Thu, 17 May 2007 16:12:05 GMT

This is a lan to lan static tunnel.

Filtering traffic that is traveling thru the established tunnel is what I am trying to accomplish.

The endpoints are 2 devices by a company called SonicWall. The tunnel simply passes thru my firewall and I don't have access to the other devices to insure the security I desire.

Re: Filtering Tunnels

Richard Burts — Fri, 18 May 2007 16:37:44 GMT

Chris

If an encrypted VPN site to site tunnel is passing through your firewall I do not know of any way that you can examine or filter that traffic. Part of the purpose of IPSec VPN is that no intermediate device along the VPN path can see the data being transported.

HTH

Rick