CVPN Client to PIX 501 Access Restrictions?

[carllougher]

Hi,

How do I restrict vpn client access to certain servers on the inside network?

I can do it using access lists on the inside interface from the Lan servers to the vpn client but how do I restrict access the other way?

Sample:

VPN Client 10.10.10.1

Lan server : 192.168.1.1

Only allow vpn client to talk to the inside server using telnet. All other ports blocked.

Cheers,

Taff

[thisisshanky]

You apply the crypto map on outside int. of the pix (mostly)...so if the server is a on dmz or inside interface you can define an ACL on the PIX that is applied in inbound direction that blocks all traffic from the respective servers going to 10.10.10.0 network from being blocked. Used extended acl for more granularity as far as port information.

HTH

[carllougher]

Thanks for the reply.

I already have this setup but can only restrict access on an ip level from the server to the client.

Issue with this setup is that if you want to restrict access to say just telnet from the vpn client to the server you don't know what port the server will reply to and therefore can't block or allow access as the server destination port won't be port 23.

Is there another way of doing this??