VNC over SSL-VPN tunnel

vncvpn

I've setup a SSL-VPN using Cisco ASA with AnyConnect client.
The ASA is behind a IPS/Router. A handful of Linux machines have VNC setup behind the ASA.

I want to allow VNC over SSL-VPN connection (since VNC is unsecured in pure form) in remote access settings. It's a strict settings to block all ports except the necessary ones.

I'm trying to implement enough ACLs to block all unsecured connections.

Would my IPS/Router have to block regular VNC port since VNC is tunneled under SSL, but then would my ASA or any other device need to open up a port for VNC once the client is inside the local network?
Is my IPS/Router going to dissect the packet and block it if it has VNC in it? (if IPS/Router blocks VNC, but NOT SSL).

Thank you.

Best Answer

You would only need to allow SSL (port 443).

Because your VNC traffic is going to get piggybacked by SSL.

From the IPS/Router's stance, VNC traffic is going to look like SSL.

Related Topic