VPN access to a server locate in outside

[Adr3nalin]

Hi all,

i have configured VPN Client ver 3.5.1/IPSEC/IAS RADIUS using PIX515E version 6.1
with this command
nat (inside) 0 access-list ...
nat (dmz) 0 access-list ....

it works great, we could access to all servers locate in dmz and in inside network via the VPN CLient

we have a server that was put between two firewall.
--- FW1---SERVERA----PIX515E----

these serverA is not natted, and use the internet ip address.

the question is, is it possible to access this box via VPN connection ? if yes, how or which command i have to put it in PIX ? thanks in advance for your help.

 

[yizhar]

HI.

Where is SERVERA connected to from the pix point of view?
Is SERVERA on the "outside" of the pix?
If so, why do clients need the VPN tunnel and do not access SERVERA directly?
Or maybe this is the correct diagram:
SERVERA - FW1 - Internet - Pix outside
???
And how do internal hosts access SERVERA?
Is there an additional VPN tunnel? access-list?

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[Adr3nalin]

Hi Yizhar...

the config is:

from public network, traffic is filtered with first Firewall (pass through / no nat translation, only do packet filtering ) to a network with internet ip address where ServerA belongs (the reason we put serverA in here cause this server has some services that incompatible with NAT)and then this network is bock again with the PIX firewall (do NATting, have outside, dmz and inside interface)

the PIX also configured as VPN server (IPSEC),
and the client from internet could access the DMZ and inside network through Cisco VPN client.
i would like this client could control (for example using terminal services ) to this BOX, for security consideration we do not want to open the first firewall that port...
and prefer using the VPN first..

thanks.

 

[yizhar]

HI.

Well, the pix will never forward packets back to the interface it came from, so you should find other solution, for example:

* Decide if you realy need to remote control that server.

* Install an additional TS on the "inside" of the pix.
The remote adminitstartor will access it first, then access SERVERA from it.

* Install PCAW or other remote control app on that server, but set it only for manual start-up, and open required port at FW1. When remote control is needed, a local person will need to launch the remote control server on SERVERA.
This is of course more secure then always waiting but I don't know if it is practical for you.

* Setup SERVERA as a VPN server for accessing the server itself. A remote manager will need to establish VPN connection to SERVERA before accessing it with TS.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar