VPN access to DMZ through other Network

Yes! I had this exact problem. This was a major scourge for me. The trick is that you need to disable sysopt connect permit-ipsec and then use regular access lists.

First, make sure your match address in the crypto map includes the 5.0 to 3.0 acl and visa versa on the remote firewall

Then you have the problem that people in your DMZ on the 3.0 network can access your inside on the 5.0 network (you probably dont want that, as I didn't). This is where you disable the bypass of ACL checks for vpn traffic (no sysopt connection permit-ipsec) and then use regular ACL rules:

setup your networks in object groups and use the following:

Firewall 1 (5.0 inside)

no sysopt connection permit-ipsec

access-list from_outside extended deny ip object-group remote_dmz object-group local_inside access-list from_outside extended permit ip object-group remote_inside object-group local_inside

Firewall 2 (1.0 inside, 3.0 DMZ)

no sysopt connection permit-ipsec

access-list from_outside extended permit ip object-group remote_inside object-group local_dmz access-list from_outside extended permit ip object-group remote_inside object-group local_inside

Geez, that looks easy enough. I have 5 other VPNs too though, I'd have to create ACLs for them as well, right?

------- cut ------------ floodguard enable sysopt connection permit-ipsec crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac crypto map outside_map 20 ipsec-isakmp crypto map outside_map 20 match address to_arkansas crypto map outside_map 20 set peer 64.x.x.x crypto map outside_map 20 set transform-set ESP-AES-128-MD5 crypto map outside_map 30 ipsec-isakmp crypto map outside_map 30 match address to_charleston crypto map outside_map 30 set peer 66.x.x.x crypto map outside_map 30 set transform-set ESP-AES-128-MD5 crypto map outside_map 50 ipsec-isakmp crypto map outside_map 50 match address to_meltech crypto map outside_map 50 set peer 199.x.x.x crypto map outside_map 50 set transform-set ESP-AES-128-MD5 crypto map outside_map 60 ipsec-isakmp crypto map outside_map 60 match address to_raines crypto map outside_map 60 set peer 216.x.x.x crypto map outside_map 60 set transform-set ESP-AES-128-MD5 crypto map outside_map 70 ipsec-isakmp crypto map outside_map 70 match address to_moriah crypto map outside_map 70 set peer 65.x.x.x crypto map outside_map 70 set transform-set ESP-AES-128-MD5 crypto map outside_map 80 ipsec-isakmp crypto map outside_map 80 match address to_ivs crypto map outside_map 80 set peer 66.x.x.x crypto map outside_map 80 set transform-set ESP-AES-128-MD5 crypto map outside_map interface outside isakmp enable outside isakmp key ******** address 64.x.x.x netmask 255.255.255.255 no-xauth no-config-mode isakmp key ******** address 66.x.x.x netmask 255.255.255.255 no-xauth no-config-mode isakmp key ******** address 216.x.x.x netmask 255.255.255.255 no-xauth no-config-mode isakmp key ******** address 199.x.x.x netmask 255.255.255.255 no-xauth no-config-mode isakmp key ******** address 65.x.x.x netmask 255.255.255.255 no-xauth no-config-mode isakmp key ******** address 66.x.x.x netmask 255.255.255.255 no-xauth no-config-mode isakmp policy 20 authentication pre-share isakmp policy 20 encryption aes isakmp policy 20 hash md5 isakmp policy 20 group 5 isakmp policy 20 lifetime 86400

------- cut ---------