IPSec phase 2 to an IP Range
-
I have to pass a set of IP's from one network to another without opening up the entire network. For example. I have these workstations on the regular lan that need to access the lan of a remote site, but I don't want the entirety of the local lan of site A to see site B.
Set say site A is 10.50.0.0/23, pfSense at 10.50.0.1, desktops in question are static at 10.50.0.90-99 and that needs to see 10.51.0.0/23.
Granted, I could firewall it, but since both locations have 5 IPSec tunnels each and at least 4 of them need ipv4 any all * type stuff, it goes from a single record proposition to a 6 record ordeal.
Not sure I can CIDR it either. I would need two /29s to cover it and then some and I am unsure of it would work.
-
I'm not 100% sure this will work, but have you tried adding each of the PCs as a separate /32 address? I have the reverse scenario where I have a VPN connection to a remote server where the remote address is specified as a /32.
Otherwise I think you would be able to do two /29 blocks - x.88/29 and x.96/29, although obviously any other device within those blocks would also gain access.
Or, would a floating firewall rule set help simplify things? In case you don't know, you can also create a single alias which can include all of the PC IP addresses.
-
@rolytheflycatcher
I have an Alias of static IP computers that should have access to our network management VLAN at the office which houses vCenter, sans. switches, etc... We also have racks at a datacenter in the city which has a "core" firewall that houses it's network management which is just an SG3100 which also has SANs and a VMware cluster. I may do the /29's to see if that works and then I can try an bolster it I guess with a deny inverse AllowedIPs . Maybe that will be enough. -
OK - That worked.
Two /29 Phase 2's isn't super elegant, but it is better than having 10. I guess I could have done the full /23, but the more locked down the better IMHO.
I guess that is an interesting discussion, if any cyber security experts want to weigh in.
-
@phlmike you can probably add each PC with a /32, which might 'read' more elegantly than the two /29.
I'm also wondering if the Alias you have already created could be utilised in the phase 2 declaration for this purpose. Never tried it.