cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2748
Views
1
Helpful
6
Replies

FTD FDM sysopt permit-vpn for site-to-site

Greg Terkanian
Level 1
Level 1

I'm aware of how to set this for remote access VPN via group policy, however I want to set this for site-to-site VPN.  I understand that the command is global and should apply to remote access AND site-to-site, however this client isn't doing remote access and doesn't have a RA license, therefor I cannot edit the default group policy.

 

Thanks in advance.

1 Accepted Solution

Accepted Solutions

rschlayer
Level 4
Level 4

Hello @Greg Terkanian 

Just tried it in my lab, you can configure it using FlexConfig in FDM.

 

Best regards

Rick

 

View solution in original post

6 Replies 6

TJ-20933766
Spotlight
Spotlight

I'm not sure there's a way to do this. If I understand you correctly, you're running FDM and want to allow traffic from the remote side of the site-to-site VPN tunnel. Following this article: https://www.petenetlive.com/kb/article/0001681, towards the bottom he talks about having to create a rule on the outside interface allowing the networks from the remote side of the tunnel.

Does this help?

Yeah, I know I can manually put the rules in to allow the traffic, but for an appliance that has a lot of tunnels, it would be nice to globally allow this traffic. It was easy on the ASA (like everything else).
Thanks.

@Greg Terkanian I've not tried it myself, but use flexconfig to configure the sysopt command.

rschlayer
Level 4
Level 4

Hello @Greg Terkanian 

Just tried it in my lab, you can configure it using FlexConfig in FDM.

 

Best regards

Rick

 

@rschlayer can you provide a bit more detail on how you did this?  My flexconfig deployment does not give any errors but the command is not showing up in the config.  I am on v7.3.1 FPR-1010

Thanks

@rschlayer please disregard.  It seems like sysopt connection permit-vpn is now the default which I can see if I do "show running-config all".