I've setup a SSL-VPN using Cisco ASA with AnyConnect client. The ASA is behind a IPS/Router. A handful of Linux machines have VNC setup behind the ASA.

I want to allow VNC over SSL-VPN connection (since VNC is unsecured in pure form) in remote access settings. It's a strict settings to block all ports except the necessary ones.

I'm trying to implement enough ACLs to block all unsecured connections.

Would my IPS/Router have to block regular VNC port since VNC is tunneled under SSL, but then would my ASA or any other device need to open up a port for VNC once the client is inside the local network? Is my IPS/Router going to dissect the packet and block it if it has VNC in it? (if IPS/Router blocks VNC, but NOT SSL).

Thank you.


You would only need to allow SSL (port 443).

Because your VNC traffic is going to get piggybacked by SSL.

From the IPS/Router's stance, VNC traffic is going to look like SSL.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.