Very Computer

by **Brad** » Thu, 27 Feb 2003 01:55:17

Is there any way to get the decrypted client traffic to pass through the
access-lists on a pix firewall, everything I found bypasses the
access-lists.

Use the sysopt connection permit-ipsec command in IPSec configurations to
permit IPSec traffic to pass through the PIX Firewall without a check of
conduit or access-list command statements

The sysopt ipsec pl-compatible command allows IPSec packets to bypass the
NAT and ASA features and enables incoming IPSec packets to terminate on the
sending interface.
The sysopt ipsec pl-compatible command is not available on a PIX 501.

by **Brian Bergi** » Thu, 27 Feb 2003 02:31:56

|
|The sysopt ipsec pl-compatible command is not available on a PIX 501.
|

Anyone have a list of what's NOT available on a 501? Cisco has not been
forthcoming with that info.

Thanks...
Brian Bergin

I can be reached via e-mail at
cisco_dot_news_at_comcept_dot_net.

by **Walter Robers** » Thu, 27 Feb 2003 03:25:07

:Is there any way to get the decrypted client traffic to pass through the
:access-lists on a pix firewall, everything I found bypasses the
:access-lists.

Sure, just do NOT use the sysopt's.

:Use the sysopt connection permit-ipsec command in IPSec configurations to
:permit IPSec traffic to pass through the PIX Firewall without a check of
:conduit or access-list command statements

And without it, ACL's are checked after the packet is decrypted.

:The sysopt ipsec pl-compatible command allows IPSec packets to bypass the
:NAT and ASA features and enables incoming IPSec packets to terminate on the
:sending interface.
:The sysopt ipsec pl-compatible command is not available on a PIX 501.

This feature is present on some PIX to support the pre-IPSec method
of doing VPNs. This feature is otherwise obsolete.
--
IEA408I: GETMAIN cannot provide buffer for WATLIB.

Very Computer

PIX client access restrictions

PIX client access restrictions

PIX client access restrictions

PIX client access restrictions