I've setup a SSL-VPN using Cisco ASA with AnyConnect client. The ASA is behind a IPS/Router. A handful of Linux machines have VNC setup behind the ASA.
I want to allow VNC over SSL-VPN connection (since VNC is unsecured in pure form) in remote access settings. It's a strict settings to block all ports except the necessary ones.
I'm trying to implement enough ACLs to block all unsecured connections.
Would my IPS/Router have to block regular VNC port since VNC is tunneled under SSL, but then would my ASA or any other device need to open up a port for VNC once the client is inside the local network? Is my IPS/Router going to dissect the packet and block it if it has VNC in it? (if IPS/Router blocks VNC, but NOT SSL).