Access Control to Hosts on the inside of a VPN

[csturmey]

I have a PIX 515 to which I am connecting via a Client to Site (PPTP). On the inside network I have a list of hosts to which I want the client to have access. I do not want them to be able to gain access to the whole internal network.

Is it possible to pass traffic that exits the tunnel, through ACLs?

[sachinraja]

in case you have a ACS you can have static IPs for each user and authorize the user to access certain hosts only.. for PPTP its tough otherwise..

In case you have IPSEC tunnels, you can have different groups and give access to each group without ACS.. u just need to play with ACL's ..

Raj

[csturmey]

Thanks for that. I think the situation that I have may be easier. It will be the same hosts for all users so I don't need to differentiate between them.

What appears to happen is that the VPN is terminated on the inside of the access lists and I therefore have no control.

[jasobrown]

Remove the sysopt connection permit-pptp and then use the ACL on the "outside" interface to control the traffic.