2

I am using the ADSM for ASA tool.

I am trying to connect a service to a mysql server using port 3306. The service runs on a server that is on another network to the mysql server. It has been established that these 2 servers can communicate via a site-to-site VPN using SSH.

My question is which interface(s) would I apply an ACL allowing access strictly between these 2 servers using port 3360 on - considering it these are connected via a site-to-site VPN connection?

I assumed that ACL's that are applied to the site-to-site's VPN's ACL/filter profile would work, but I am still getting connectivity issues. Is there additional configuration needed on an interface under Access Rules? or does my ACL rule need to be moved to the outside_in or outside_access_in ACL?

Thanks for any help in advance.

Improve this question
0
3

With site-to-site tunnels, there are generally 2 ACLs on each side of the tunnel: 1 ACL allows the traffic to enter the firewall itself, then the other ACL defines which traffic is to be sent over the tunnel (generally called "interesting traffic"). You would need both ACLs to account for your traffic flow. The first, to authorize the server to talk with its partner, and the other to tell it that the traffic is part of a tunnel, so it knows how to reach the destination.

Edit (examples of the ACLs on each side of the tunnel):

Firewall 1:

access-list from-inside extended permit tcp host xxx.xxx.xxx.xxx host yyy.yyy.yyy.yyy eq 3306

access-list site-to-site-acl extended permit ip host xxx.xxx.xxx.xxx host yyy.yyy.yyy.yyy

Firewall 2:

access-list from-inside extended permit tcp host yyy.yyy.yyy.yyy eq 3306 host xxx.xxx.xxx.xxx

access-list site-to-site-acl extended permit ip host yyy.yyy.yyy.yyy host xxx.xxx.xxx.xxx

So, the from-inside ACL is allowing the traffic into the firewall (with those source and destinations inverted on either side), and the site-to-site-acl accounts for the traffic to be sent over the tunnel on each side (with the source and destinations inverted on either side). The only difference in what I wrote is that one is limiting the protocol to TCP and the port to 3306, while the other is allowing "ip", meaning it allows all protocols and all ports). The reason for that is, each time you need to allow something else over the tunnel, you don't have to change the crypto-map ACL (which would require bouncing/rebooting the tunnel - you can just add an entry on the from-inside ACL to allow the traffic in, and leave the site-to-site-acl alone.

For the record, this is only valid for policy-based site-to-site tunnels. Route-based tunnels do not use crypto maps or the associated "interesting traffic" ACL.

Improve this answer
6
  • Thanks Jesse, when you say 2 ACLs are we talking about ACLs on each of the two routers or are we talking about the inside and outside interface of one of the routers. Sorry, just trying to get my understanding clear. :) – CrazyHorse019 Jun 11 '19 at 9:36
  • @CrazyHorse019 I edited my answer to include examples for you. – Jesse P. Jun 11 '19 at 11:27
  • So I have both this: access-list filter_site2siteVPN extended permit object-group object service object mysql_server eq 3306 and access-list inside_access_in extended permit ip any any I feel this should work? – CrazyHorse019 Jun 11 '19 at 13:13
  • @CrazyHorse019 I can't really say without seeing what the other side's ACLs look like. – Jesse P. Jun 11 '19 at 13:41
  • fair enough, i am unable to see the other side as it belongs to another customer but they are getting theirs checked. Thanks for your answer though - that did clear things up for me :) – CrazyHorse019 Jun 11 '19 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.