0

I've setup a SSL-VPN using Cisco ASA with AnyConnect client. The ASA is behind a IPS/Router. A handful of Linux machines have VNC setup behind the ASA.

I want to allow VNC over SSL-VPN connection (since VNC is unsecured in pure form) in remote access settings. It's a strict settings to block all ports except the necessary ones.

I'm trying to implement enough ACLs to block all unsecured connections.

Would my IPS/Router have to block regular VNC port since VNC is tunneled under SSL, but then would my ASA or any other device need to open up a port for VNC once the client is inside the local network? Is my IPS/Router going to dissect the packet and block it if it has VNC in it? (if IPS/Router blocks VNC, but NOT SSL).

Thank you.

Improve this question

1 Answer 1

Reset to default
0

You would only need to allow SSL (port 443).

Because your VNC traffic is going to get piggybacked by SSL.

From the IPS/Router's stance, VNC traffic is going to look like SSL.

Improve this answer

You must log in to answer this question.