cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1788
Views
5
Helpful
3
Replies

VCS expressway firewall rules

nuinoahmed
Level 1
Level 1

Hello,

I just need your confirmation about the following setup.

VCSC ------  FW ------- Internet

                        |

                        |

                    VCSE

We are using Dual Nic option key with NAT.

VCS expressway wil be connected with only 1 LAN interface to FW.  It will have a private ip address.  Firewall will be Natting the VCSE private ip address to a public ip address.

When updating the FW rules as per following link:

http://www.cisco.com/en/US/docs/telepresence/infrastructure/vcs/config_guide/Cisco_VCS_Basic_Configuration_Cisco_VCS_Control_with_Cisco_VCS_Expressway_Deployment_Guide_X7-1.pdf

Appendix 3 - Page 55-58

What VCS expressway  ip address do you need to use for FW rules?  private or public one?

Thanks in advance.

Ahmed

1 Accepted Solution

Accepted Solutions

Martin Koch
VIP Alumni
VIP Alumni

Hi Ahmed!

If you use the VCS-E with the dual interface option for NAT with only one interface all communication,

from the internet and from your internal network have to go to the _public_ ip address, not the private

one. So its not only on the firewall, but also the destination for the traversal zone on the VCS-C.

Regards your firewall it will depend on what your firewall needs to have configured.

Some firewalls (or at least the admins/users) seem to have issues getting the vcs-e reached from intenal on the

external ip. If this is an issue you would need to use the secondary interface of the vcs and define an additional

dmz.

Please remember to rate helpful responses and identify helpful or correct answers.

Please remember to rate helpful responses and identify

View solution in original post

3 Replies 3

Martin Koch
VIP Alumni
VIP Alumni

Hi Ahmed!

If you use the VCS-E with the dual interface option for NAT with only one interface all communication,

from the internet and from your internal network have to go to the _public_ ip address, not the private

one. So its not only on the firewall, but also the destination for the traversal zone on the VCS-C.

Regards your firewall it will depend on what your firewall needs to have configured.

Some firewalls (or at least the admins/users) seem to have issues getting the vcs-e reached from intenal on the

external ip. If this is an issue you would need to use the secondary interface of the vcs and define an additional

dmz.

Please remember to rate helpful responses and identify helpful or correct answers.

Please remember to rate helpful responses and identify

Thanks Martin,

We suggested to customer the option to use the second interface but he prefer to use only one.  So FW admin will have to make it working with public ip address :-)

So I will ask for FW rules using the public ip address.

Best regards,

Ahmed

Hi Ahmed!

Thank you for your feedback! (+5 for you).

Yes, and I would not be surprised if it will end up of the customer using a second dmz and the second interface ;-)

VCS-C - FW - (1) VCS-E (2) - FW - Internet

Please remember to rate helpful responses and identify helpful or correct answers.

Please remember to rate helpful responses and identify

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: