PIX Access-lists

[MDewayne]

Can someone please help the slow kid!!!. I have a PIX to PIX VPN and I want to only allow access to a specific host on a specific port, but it's not working cause I don't believe my ACL is correct. Can someone help me out ??


This works:
access-list Remote_VPN permit ip host 10.254.10.12 10.250.12.0 255.255.255.0
access-list Nonat-VPN_Traffic permit ip host 10.254.10.12 10.250.12.0 255.255.255.0

This doesn't:

What am I doing wrong ??.
access-list Remote_VPN permit ip host 10.254.10.12 10.250.12.0 255.255.255.0 eq www
access-list Nonat-VPN_Traffic permit ip host 10.254.10.12 10.250.12.0 255.255.255.0 eq www

What am I doing wrong ??.

 

[HHaskel]

I am not an expert in this field but maybe if you try:

access-list Remote_VPN permit ip host 10.254.10.12 eq

http://www 10.250.12.0

255.255.255.0
access-list Nonat-VPN_Traffic permit ip host 10.254.10.12 eq

http://www 10.250.12.0

255.255.255.0


/Hakan

 

[Cluebird]

How about this:

access-list Remote_VPN permit tcp host 100.254.10.12 10.250.12.0 255.255.255.0 eq www
access-list Nonat_VPN_Traffic permit tcp host 10.254.10.12 10.250.12.0 255.255.255.0 eq www

This will only allow port 80 web traffic. Without a third line to permit ip any any, you'll drop any other traffic. Remember, ip doesn't look at the ports. If you want to look at ports, you have to go up to layer 4 and TCP.

 

[MDewayne]

Cluebird,

I'm sorry, I posted my ACL incorrectly, actually, I have actually what you suggested, but it's not working. I had the admin on the other side use the same ACL except switch
it around and make 10.250.12.0 firs in his ACL, but he says it doesn't work.

access-list Remote_VPN permit tcp host 10.254.10.12 10.250.12.0 255.255.255.0 eq www
access-list Nonat-VPN_Traffic permit tcp host 10.254.10.12 10.250.12.0 255.255.255.0 eq www

Is this a valid PIX ACL ??

access-list 102 permit ip 192.168.11.0 255.255.255.0 eq

http://www host

10.161.210.101

 

[Cluebird]

MDewayne,

I need more information. What version of code are you running on the PIXen? Are you terminating the VPNs on the outside interface? Are you getting xlates? What interfaces are involved? The access-lists have to inspect based on the way the packets look coming in to the interface. Where are you applying the access-list? Are you logging for hits against the access-lists to see if they're even being used? Right now, I'm guessing in the dark. Can you post your configs?

Regarding the valid ACL: You're permitting ip so the transport layer port 80 won't be inspected because any ip traffic is permitted between the addresses.