1. Home
  2. Cisco Systems
  3. Security issue within the VPN

Security issue within the VPN

Hi there,

I want use a VPN connection to let certain customers access a server in my DMZ. I'm using a PIX firewall as VPN server and CISCO VPN client to connect. I have several servers in the DMZ. My question is how can I restrict the customer's access to the other servers. In my tests when the VPN is established i can ping the other servers as well. Also i can connect the other servers and explorer the hard drive, of course i need to login first. I want connection only restricted to that one particular server.

Any suggestions?

Thanks Greg

Reply to
GREGTAP
Loading thread data ...

build a "vendor" group and only permit it to that device.

Reply to
Brian V

another option: make sure the "sysopt connection permit-ipsec" command is NOT in your pix... then all vpn users must still pass through your outside ACL... you can define a simple statement in your acl to only permit them to talk to that one server.

(that command is slightly different in 7.x)

eg: if your vpn users are given addresses from 192.168.255.x access-list outside_acl permit ip 192.168.255.0 255.255.255.0 host

192.168.1.5 255.255.255.255 (where 192.168.1.5 is your server) make sense?
Reply to
john smith

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.