5

interface "ldap"

access-group ldap_access_in in interface ldap
access-group ldap_access_out out interface ldap

I had zero hits until I started to try ssh;

access-list ldap_access_out line 1 extended deny tcp host 10.99.2.70 host 10.99.11.8 eq ssh (hitcnt=5) 0xa18d6298 

If I wait ten minutes without connecting, no hits. Checking on the remote host who is logged on I can see that the source address is what I expect it to be, and capture captures the traffic.

4 minutes after the previous tries, I will now connect three times and check the hit count:

[user@ldap0 ~]$ ssh 10.99.11.8
Last login: Thu Nov 20 13:48:34 2014 from 10.99.2.70
[user@root0 ~]$ logout
Connection to 10.99.11.8 closed.

[user@ldap0 ~]$ ssh 10.99.11.8
Last login: Thu Nov 20 13:53:23 2014 from 10.99.2.70
[user@root0 ~]$ ^C
[user@root0 ~]$ logout
Connection to 10.99.11.8 closed.

[user@ldap0 ~]$ ssh 10.99.11.8
Last login: Thu Nov 20 13:53:24 2014 from 10.99.2.70
[user@root0 ~]$ logout
Connection to 10.99.11.8 closed.

And ...

access-list ldap_access_out line 1 extended deny tcp host 10.99.2.70 host 10.99.11.8 eq ssh (hitcnt=8) 0xa18d6298 

I don't have sysopt permit-vpn (this is ipsec traffic incoming on outside interface, routed to ldap interface.

What could be the cause of this?

2

It turns out 'sysopt connection permit-vpn' is implicit, meaning you don't see it in the config (unless you actually have no sysopt connection permit-vpn).

2
  • FYI, it's generally considered good practice to explicitly permit or deny vpn traffic with your acl – Mike Pennington Dec 9 '14 at 10:01
  • I do explicitly permit my vpn traffic using both ingress and egress interface access-lists, or so I thought. It was simply a matter of negating permit-vpn and most (99%) allowed access was explicitly configured in ACLs. – user135361 Dec 10 '14 at 9:10
1

It's not readily clear what the issue is. Your ASA is still acting like permit-vpn is turned on. :(

In general, it's good to have a little more flexibility than what the permit-vpn sysopt will allow you since it's global. You can apply a vpn filter to that user's group policy

I'd try this just to ensure it does work:

group-policy MYVPN internal
group-policy MYVPN attributes
 vpn-filter value ldap_access_out

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.