Access-list blocks VPN traffic

[rlyj]

Hi,

A site to site VPN is established between 2 networks and had no problem until we replaced CPFW with the PIX and added some access-lists to block outbound access. From the logs, the traffic between 2 networks are blocked by these access-lists. Shouldn't sysopt and nat 0 commands force PIX to bypass access check for VPN traffic? Now we have to add access-lists to allow the traffic from the local network to remote network. Any idea? TIA.

Randy

 

[chicocouk]

If you have sysopt connection permit-ipsec in the config then vpn traffic bypasses the ACLs on the pix. But that's the VPN traffic coming INTO out of a vpn

The reason being the command actually means allow traffic that has been decrypted to bypass ACLs. But outbound traffic from your internal network hasn't been decrypted. It hasn't yet BEEN encrypted, the pix is about to do that. So the sysopt command isn't relevant. You do have to specify ACLs to allow traffic to the remote end of the vpn if you've got ACLS blocking outgoing traffic, this is normal behaviour.

NAT 0 has nothing to do with bypassing ACLs by the way, it just means don't nat traffic between the specified subnets.

The reason sysopt connection permit-ipsec usually "just works" is that most people don't put rules on to block outbound traffic (although they should do), and by default the pix allows all outbound traffic, so they don't usually come across the issue.

chico

CCNA, MCSE, Cisco Firewall specialist, VPN specialist, wannabe CCSP

 

[chicocouk]

Cisco's definition of sysopt connection permit-ipsec probably explains it better than i just have;

"sysopt connection permit-ipsec: Implicitly permit any packet that came from an IPSec tunnel and bypass the checking of an associated access-list, conduit, or access-group command statement for IPSec connections."

Your outbound traffic didn't "come from an IPSec tunnel"

CCNA, MCSE, Cisco Firewall specialist, VPN specialist, wannabe CCSP

 

[rlyj]

Thanks for the reply and info chico.

Randy