Re: PIX - VPN with IPSec

Hi Arek,

If you want to all only one webserver on your private network for the vpn
tunnel, i think the best way is to add only this entry in the crypto ACL on
pix. This way you should be able to control what your remote network can
access.

If you don't want to trust encrypted traffic, you can remove sysopt and
replace it with an ingress ACL. This ingress ACL should be mirror of your
crypto ACL so that remote networks can access your private network.

Have you already tried both the above methods?


thanks,
krishna
----- Original Message -----
From: "Arek Słomiński" <aslom@paytel.pl>
To: <firewalls@securityfocus.com>
Sent: Tuesday, August 17, 2004 6:23 PM
Subject: PIX - VPN with IPSec


Hi Guys,

Our company plans to establish an IPSec VPN tunnel to one of our customers.
Some resources should be shared for the customer and the easiest way is to
let secured access to the data via  Internet. We prepared testing
environment with PIX515 and Linksys VPN router. The data are crypted fine
but there is no access control within the VPN channel.
We added PIX command "sysopt connection permit-ipsec" on PIX and it let's
all inbound traffic from Linksys router via IPSec tunnel, nothing even
acls!!! I do not want all inbound traffic welcome to my LAN behind PIX - all
I need is for example access to one web server inside.
Pls, advise how to fix it.

Regards
Arek