You'll have to take off sysopt connection permit-ipsec before those ACLs
take effect.
Note that this may affect other VPNs if you have them.
tv
----- Original Message -----
From: "JR Colmenares" <[EMAIL PROTECTED]>
To: "Ryan Bradley" <[EMAIL PROTECTED]>; "Cisco NSP Forum"
<[email protected]>
Sent: Friday, October 24, 2008 6:23 AM
Subject: Re: [c-nsp] Restric access in a VPN tunnel
Very appreciated Ryan. Thanks for your reply
--- On Wed, 10/22/08, Ryan Bradley <[EMAIL PROTECTED]> wrote:
From: Ryan Bradley <[EMAIL PROTECTED]>
Subject: RE: [c-nsp] Restric access in a VPN tunnel
To: [EMAIL PROTECTED]
Date: Wednesday, October 22, 2008, 9:46 AM
Define each protocol and port number per host
access-list nonat permit tcp host 10.10.20.1 eq 1433 host
192.168.16.2
eq 1433
access-list nonat permit tcp host 10.10.20.1 eq 1433 host
192.168.16.3
eq 1433
This should solve your second issue by restricting who is
allowed over
the tunnel and on what port number and protocol.
Ryan
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of JR
Colmenares
Sent: Friday, October 17, 2008 11:54 PM
To: Cisco NSP Forum
Subject: [c-nsp] Restric access in a VPN tunnel
Cisco 506e
6.3.4
I am configuring a tunnel and I have this access list that
allows
traffic from the remote site to our whole subnet
access-list nonat permit ip 10.0.0.0 255.0.0.0 192.168.16.0
255.255.255.0
access-list remote_site permit ip 10.0.0.0 255.0.0.0
192.168.16.0
255.255.255.0
sysopt connection permit-ipsec
Our users are going to access an database server on the
remote site
1- How can I restrict the access to particular hosts in our
network?
2- Is it possible to configure the tunnel so the IP traffic
goes just in
one direction? It seems to me that if our users need to
access their
servers, they should not need to access any hosts on our
side? Or if it
is done this way, our users would not be able to pull any
data from
those servers because the traffic just goes in one
direction. Please
provide some insight here. I am a little paranoid with this
company
wanting to establish this kind of open access
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection
around
http://mail.yahoo.com
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
