Monday, September 21, 2009

Cisco PIX restrict Internet but not VPN

If you have a PIX with a site-to-site VPN configured, you may want to allow all the internal hosts to utilize the VPN but only certain hosts to get to the Internet.  In that case, allow traffic to your internal subnet in your access list, then allow the IP's that are permitted Internet access.

access-list 1 permit ip any  <--- This allows traffic to the internal VPN
access-list 1 permit ip host any               <----This allows a specific IP Internet access
access-list 1 permit ip host any
access-list 1 permit ip host any
access-group 1 in interface inside

No comments:

Post a Comment