VPN and DMZ

[Zayar Win]

Dear ,

             I would like to get access to DMZ from remote branches via VPN Tunnel in ASA. Please see the diagram and Give me your comment.

Thanks in advance.

[Richard Burts · Accepted solution]

If the tunnels from R1 to the other routers are working then I believe that these are the things that you need to do:

- be sure that each of the remote routers has a route to the subnet of the DMZ that points through the tunnel.

- be sure that R1 has a route to the subnet of the DMZ.

- configure on the ASA security policy that permits traffic from all the networks from the routers to access the DMZ.

- configure on the ASA routes for all the networks from the routers.

HTH

Rick

[Zayar Win]

Dear Mr. Rick,

        Thanks for your help. I am almost done with this scenario with your help. I am testing in GNS3 Lab and after that I will apply this scenario in my real network .

I have a question,

1. Is ASA Default allow to DMZ from Internal (i.e from security level High to Low )

[Inside:100 =>DMZ 50 ] ?

Because In my lab I didn't create any permit access-list meanwhile inside network can access telnet , www , etc , to DMZ but ping is not allowed.

2. All remote routers can access to DMZ as same as R1. but ping is not allowed. I think that all remote is connected to internal network router , so they can access without any permit access-list.

3. Other Ports are default allow security high => Low , But Ping is not allow, How can I open ping/icmp ? ( internal to DMZ ) please give me a access-list command.

[Richard Burts · Accepted solution]

To allow ping you need to inspect it. The syntax might vary a little depending on your ASA but it should look something like this

policy-map global_policy
 class inspection_default

 inspect icmp

The default behavior of ASA is to permit access from higher level interface (like 100) to lower level interface (like 50).  So if all routers are accessing the ASA using the inside interface then they should be allowed access.

HTH

Rick