Firewall Wizards mailing list archives
RE: PIX split tunneling
From: "Perrymon, Josh L." <PerrymonJ () bek com>
Date: Wed, 19 Mar 2003 15:20:51 -0600
Hey Ben- I'm a little fuzzy also on this one. If your using split-tunnels with a client-to-PIX-VPN then the Split tunnel is setup inside the pix. VPNGROUP test split-tunnel access-list-101 VPNGROUP test DNS 10.1.1.1 10.1.1.1 so on Access-list 101 permit IP xxx.xx.xx.xx xx.xx.xx.xx xx.xx.xx.xx xx.xx.xx.xx The access list specifies the split tunnel. What to encrypt and what to send out the interface( default gateway ). Split tunneling is an excellent option for saving bandwidth and SA's on your firewall. The idea might have been started with the thought that if you send internet traffic back to the VPN you will be safe. This is incorrect. To use a VPN the user would need access to the internet ( Public ). This means that the tcp/ip stack / ports are open unless protected. Meaning if you have 135-139 open your not safe. I would recommend that the users are required to run a personal firewall. Else you have a Secure connect to the core of the LAN for hackers to ride.... Something to think about-- Joshua Perrymon Network Security Consultant -----Original Message----- From: Ben Nagy [mailto:ben () iagu net] Sent: Wednesday, January 29, 2003 2:09 AM To: Malte von dem Hagen Cc: firewall-wizards () honor icsalabs com Subject: Re: [fw-wiz] PIX split tunneling Random tip: Search the Cisco site with Google with "my query words site:cisco.com" It works better. As for the question, it isn't possible to stop end users on remote networks trying to send secure network traffic out via the Internet. It's their machine, they can mess with it. You can ship a preconfigured client, from memory, which can help with rollout issues, but if it's just a remote laptop on a public network then if they change the config then they change it. If your users are inside the PIX then I don't understand the question. All this fancy "split tunneling" jargon seems to mean is that you don't actually _need_ to tunnel all traffic. Wow. Revelation. If the client VPN associations are with the firewall nearest to them (in your network) , then you can then configure that firewall to forward the traffic however you like after that. It can even re-tunnel some to a remote network and send the rest out via the Internet. If the client sessions are with a remote firewall (not in your network) then you can't touch the data inside the sessions. You can always choose to forward, tunnel, or block the packets, though. Maybe I'm missing something. ----- Original Message ----- From: "Malte von dem Hagen" <DocValde () gmx de> To: "'Firewall Wizards ML'" <firewall-wizards () honor icsalabs com> Sent: Wednesday, January 29, 2003 3:08 AM Subject: [fw-wiz] PIX split tunneling
Hi there, what we want to setup is a VPN from Cisco VPN Client to a Cisco PIX 525 including split tunneling, in order to split up the outgoing client traffic - the packets destinated to the secured network via the vpn tunnel, all the others through the default gateway. This should be confed at the pix and not at the VPN client in order to prevent user manipulation of these things. Searching the web and CCO was quite frustrating since cisco has almost everything provided on their websites, but to find the right documents is a mess... Does anybody have some clues, links, configuration examples? TIA & best regards, Malte von dem Hagen -- Malte von dem Hagen DocValde () gmx de http://www.docvalde.net/ _______________________________________________ firewall-wizards mailing list firewall-wizards () honor icsalabs com http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
_______________________________________________ firewall-wizards mailing list firewall-wizards () honor icsalabs com http://honor.icsalabs.com/mailman/listinfo/firewall-wizards _______________________________________________ firewall-wizards mailing list firewall-wizards () honor icsalabs com http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
Current thread:
- RE: PIX split tunneling Perrymon, Josh L. (Mar 19)