VPN traffic to dmz

Similar Questions

• Cisco ASA VPN tunnel question - DMZ interface

  I am trying to build a tunnel to a customer with NAT and I'm able to get 3 of the 4 networks to communicate. The 1 that is not responding is a DMZ network. Excerpts from config below. What am I doing wrong with the 10.0.87.0/24 network? The error in the log is "routing cannot locate the next hop.

  interface Ethernet0/1
  Speed 100
  half duplex
  nameif inside
  security-level 100
  the IP 10.0.0.1 255.255.255.0
  OSPF cost 10
  send RIP 1 version
  !
  interface Ethernet0/2
  nameif DMZ
  security-level 4
  IP 172.16.1.1 255.255.255.0
  OSPF cost 10

  network object obj - 172.16.1.0
  subnet 172.16.1.0 255.255.255.0

  object network comm - 10.240.0.0
  10.240.0.0 subnet 255.255.0.0
  network object obj - 10.0.12.0
  10.0.12.0 subnet 255.255.255.0
  network object obj - 10.0.14.0
  10.0.14.0 subnet 255.255.255.0
  network of the DNI-NAT1 object
  10.0.84.0 subnet 255.255.255.0
  network of the DNI-NAT2 object
  10.0.85.0 subnet 255.255.255.0
  network of the DNI-VIH3 object
  10.0.86.0 subnet 255.255.255.0
  network of the DNI-NAT4 object
  10.0.87.0 subnet 255.255.255.0

  the DNI_NAT object-group network
  network-object DNI-NAT1
  network-object DNI-NAT2
  network-object ID-VIH3
  network-object NAT4 DNI

  DNI_VPN_NAT1 to access ip 10.0.0.0 scope list allow 255.255.255.0 object comm - 10.240.0.0
  Access extensive list ip 10.0.12.0 DNI_VPN_NAT2 allow 255.255.255.0 object comm - 10.240.0.0
  Access extensive list ip 10.0.14.0 DNI_VPN_NAT3 allow 255.255.255.0 object comm - 10.240.0.0
  Access extensive list ip 172.16.1.0 DNI_VPN_NAT4 allow 255.255.255.0 object comm - 10.240.0.0
  access-list extended DNI-VPN-traffic permit ip object-group, object DNI_NAT comm - 10.240.0.0

  NAT (inside, outside) source static obj - 10.0.12.0 DNI-NAT2 destination static comm - 10.240.0.0 comm - net 10.240.0.0 to net non-proxy-arp
  NAT (inside, outside) source static obj - 10.0.14.0 DNI-VIH3 destination static comm - 10.240.0.0 comm - net 10.240.0.0 to net non-proxy-arp
  NAT (inside, outside) source static obj - 172.16.1.0 DNI-NAT4 destination static comm - 10.240.0.0 comm - net 10.240.0.0 to net non-proxy-arp

  Hello

  I see that the issue here is the declaration of NAT:

  NAT (inside, outside) source static obj - 172.16.1.0 DNI-NAT4 destination static comm - 10.240.0.0 comm - net 10.240.0.0 to net non-proxy-arp

  The correct statement would be:

  NAT (DMZ, external) source static obj - 172.16.1.0 DNI-NAT4 destination static comm - 10.240.0.0 comm - net 10.240.0.0 to net non-proxy-arp

  Go ahead and do a tracer of packages:

  Packet-trace entry DMZ 172.16.1.15 tcp 443 detailed 10.240.X.X

  Thus, you will see the exempt NAT works now.

  I would like to know how it works!

  Please don't forget to rate and score as correct the helpful post!

  Kind regards

  David Castro,

• Separate the internet access and VPN traffic

  Hello everyone!

  I have a VPN Client that connect with the office, the vpn works great. Now all traffic, including internet´s access goes through the tunnel. I would separate it, I know I can use a split tunnel, but does not work for me.

  Here is the config:

  internal remote group strategy
  Group remote attributes policy
  value of 192.168.0.11 WINS server
  Server DNS 192.168.0.13 value
  Protocol-tunnel-VPN IPSec
  Split-tunnel-policy excludespecified
  value of Split-tunnel-network-list Accesso_Restringido
  XXXX.xxx value by default-field

  Accesso_Restringido list extended access denied object-group ip VPN remote everything

  Any idea?

  Concerning

  KC

  You should ignore the NAT for traffic between the vpn to the DMZ network client

  1 remove the following text

  No inside_nat0_outbound access ip 192.168.0.0 scope list allow 255.255.0.0 10.10.1.0 255.255.255.0

  2. Add the following

  permit dmz_nat0_outbound to access extended list ip 192.168.0.0 255.255.0.0 10.10.1.0 255.255.255.0

  NAT (DMZ) 0-list of access dmz_nat0_outbound

• ASA 5505 VPN easy & 3rd / DMZ interface

  We have many new and very small remote sites that need to connect via an ASA5505 via easy VPN.  Works without a problem and we have the configuration and the process nailed.

  The challenge that I received today involve non standard remote sites, where I need to set up a third interface an ASA 5505 and allow it to go directly to the Internet and do not go through the VPN.  Configuration of the third interface, assignment and configuration of the ACLS / NAT (PAT) are towards the front.

  The challenge I face and have not been able to find a direct response to is if it is possible to have the easy process of extension of VPN traffic avoidance.  Currently, traffic is down the tunnel which is not what I want.

  I'm afraid I'll have to build conventional site-to-site VPN configurations which is not a huge problem, if it breaks all the methods of maintenance/operations, process, and I have to spend time training of the support team how to detect the differences.  Either yes I can build if someone else needs the support, which means different is a problem.

  Thank you

  What version of the software you run ASA?

  I found this in the configuration guide that suggests that only the highest security level interface is encrypted by the easy VPN tunnel, if you run ASA version 7.2.3 and above:

  http://www.Cisco.com/en/us/docs/security/ASA/asa82/configuration/guide/ezvpn505.html#wp1025408

  So, if your DMZ does not have the same level of security as your inside interface, DMZ traffic does not pass through the tunnel.

  Also, do you have split tunnel configured on the easy VPN server for this easy VPN clients group?

• 7.2 ASA5520 - filters VPN traffic

  Hi all,

  I would like to know how can I filter out VPN traffic with a list of access, by using the source address and port of destination as filters.

  I tried with "no sysopt permit vpn connection" but it is to filter the traffic through the VPN tunnel and I want to filter the host which can establish the VPN tunnel.

  I did it in a router with this access list:

  Note access-list 101 VPN

  access-list 101 permit ahp host x.x.x.x everything

  access-list 101 permit esp host x.x.x.x any newspaper

  access-list 101 permit host x.x.x.x esp all

  access-list 101 permit udp host x.x.x.x any eq isakmp

  access-list 101 permit udp host x.x.x.x any eq non500-isakmp

  But I tried the same thing in the ASA and does not work, I think it's because the ASA does not apply the access list for VPN traffic.

  Sincerely, Fernando.

  Fernando

  You can disable it with "no crypto isakmp are outside", but then even if you apply an acl to the outside which allows all IP, ESP, AH it still does not allow an IPSEC connection.

  So for the moment I see no way to do this without using an acl on your router upstream.

  I'll do a reading just in case I missed something.

  Jon

• Capture packets for VPN traffic

  Hi team,

  Please help me to set the ACL and capture for remote access VPN traffic.

  To see the amount of traffic flows from this IP Source address.

  Source: Remote VPN IP (syringe) 10.10.10.10 access

  Destination: any

  That's what I've done does not

  extended VPN permit tcp host 10.10.10.10 access list all

  interface captures CAP_VPN VPN access to OUTSIDE gross-list data type

  Hello

  If you have configured capture with this access list, you filter all TCP traffic, so you will not be able to see the UDP or ICMP traffic too, I would recommend using the ACL, although only with intellectual property:

  list of allowed extended VPN ip host 10.10.10.10 access everything

  Capture interface outside access, VPN CAP_VPN-list

  Then with:

  See the capture of CAP_VPN

  You will be able to see the packet capture on the SAA, you can export the capture of a sniffer of packages as follows:

    https:// /capture//pcap capname--> CAP

  For more details of capture you can find it on this link

  Let me know if you could get the information that you were trying to achieve.

  Please Don t forget to rate and score as correct the helpful post!

  David Castro,

  Kind regards

• NAT on the VPN traffic

  Hello everyone, I need help in a vpn configuration, this is the problem that I need nat all vpn traffic because I net to put into place a vpn but I already have another vpn with the same network, so that overlap with the new one, then how I can nat overlaps all traffic to another network in order to avoid the network?.

  Please I really need help

  Thank you

  You say that the 192.168.1.100 is able to go through the tunnel and the internet now?

  Try to add another...

  IP nat inside source static 192.168.1.101 10.10.44.101 map route VPN

  for example.

  Federico.

• ASA encrypt interesting VPN traffic

  Hello everybody out there using ASA.

  I had a few IPSEC VPN tunnels between the company's central site and remote sites.

  Two dsl lines were connected to the ASA, one for VPN traffic and the other for the internet.

  The default gateway has been configured online internet, some static while insured roads as traffic to the sites of the company was sent through the other line.

  A few days ago we changed the configuration of ASA to use only a single dsl connection, then the line serving the internet has been cut, while the other will become the gateway default and static routes have been removed.

  The VPN connections instant stopped working and trying to send packets to the remote lan, it seems that ASA will not recognize that the traffic is encrypted. Obviousely we checked cryptomap, acl, ecc, but we find no problem... do you have any suggestions?

  Thanks in advance,

  Matt

  -----------------------------------------------------------------------------------------------------------------------------------------------------------------

  XNetwork object network
  10.10.0.0 subnet 255.255.255.0

  network of the YNetwork object
  172.0.1.0 subnet 255.255.255.0

  card crypto RB1ITSHDSL001_map2 1 corresponds to the address RB1ITSHDSL001_1_cryptomap
  card crypto RB1ITSHDSL001_map2 1 set peer a.b.c.186
  RB1ITSHDSL001_map2 1 transform-set ESP-3DES-SHA crypto card game

  RB1ITSHDSL001_1_cryptomap list extended access permitted ip XNetwork object YNetwork

  -------------------------------------------------------------------------------------------------------------------------------------------------------------------

  Hello

  Your exit the ASA must be encrypting the traffic between XNetwork and YNetwork.

  If the ASA does not encrypt this traffic, it could be because there is a problem with the NAT configuration.

  When the ASA receives a packet, it must first check if there are ACLs that allows traffic, passes through the inspection engine and check that the associated NAT. For example, if the package is coordinated, then the private IP encryption will never take place.

  Could ensure you that packets from the XNetwork are really reach the ASA, the NAT rule is correct and you may be looking for "debugging cry isa 127" and "scream ips 127" debug to check for errors of incompatibility.

  In addition, what is the condition of the tunnel trying to communicate: "sh cry isa his"

  Federico.

• Configuration of the router to allow VPN traffic through

  I would like to ask for assistance with a specific configuration to allow VPN traffic through a router from 1721.

  The network configuration is the following:

  Internet - Cisco 1721 - Cisco PIX 506th - LAN

  Remote clients connect from the internet by using the Cisco VPN client. The 1721 should just pass the packets through to the PIX, which is 192.168.0.2. Inside of the interface of the router is 192.168.0.1.

  The pix was originally configured with a public ip address and has been tested to work well to authenticate VPN connections and passing traffic in the local network. Then, the external ip address was changed to 192.168.0.2 and the router behind.

  The 1721 is configured with an ADSL connection, with fall-over automatic for an asynchronous connection. This configuration does not work well, and in the local network, users have normal internet access. I added lists of access for udp, esp and the traffic of the ahp.

  Cisco VPN clients receive an error indicating that the remote control is not responding.

  I have attached the router for reference, and any help would be greatly apreciated.

  Manual.

  Brian

  For VPN clients reach the PIX to complete their VPN the PIX needs to an address that is accessible from the outside where the customers are. When the PIX was a public address was obviously easy for guests to reach the PIX. When you give the PIX one address private, then he must make a translation. And this becomes a problem if the translation is dynamic.

  You have provided a static translation that is what is needed. But you have restricted the TCP 3389. I don't know why you restricted it in this way. What is supposed to happen for ISAKMP and ESP, AHP traffic? How is it to be translated?

  If there is not a static translation for ISAKMP traffic, ESP and AHP so clients don't know how to reach the server. Which brings me to the question of what the address is configured in the client to the server?

  HTH

  Rick

• VPN needs access to all external internal vpn traffic traffic all in tunnel

  Hello

  Could someone help me find the problem?

  I am ASA configuration as firewall + vpn server, essentially outside of the device's access T1 (there are two VLANS in inside via an iptables, outside of iptables is on the same vlan as insdie of ASA (192.168.5.1 and 192.168.5.2).)  VPN users are authenticated via authentication 2 factors (SDI, ip is 192.168.5.5) and get the ACL by local database.  pool of VPN is 192.168.6.1 - 192.168.6.15. pool of VPN is coordinated to the external IP address

  trying to access a remote host A from the host a is open for the IP and one specific Protocol. all vpn traffic are in the tunnel. the VPN user can connected and ACL vpnuser1_ONLY not working does not as expected.

  Here is the part of configuration:

  ASA Version 8.2 (2)
  ...........

  Route outside 0.0.0.0 0.0.0.0 xx.10.194.193 1

  Route inside companynet1 255.255.255.0 192.168.5.2 1

  Route inside companynet2 255.255.255.0 192.168.5.2 1

  Route inside companynet3 255.255.255.0 192.168.5.2 1

  Route inside companynet4 255.255.255.0 192.168.5.2 1

  ...............

  Route inside companynetn 255.255.255.0 192.168.5.2 1

  
  

  NAT (inside) 4 vpnpool 255.255.255.0 outside   <--------- is="" this="">

  Global (outside) 4 xx.10.194.238 netmask 255.255.255.255

  Split-tunnel-policy tunnelall

  .....................

  vpnuser1_ONLY list extended access permitted tcp vpnpool 255.255.255.0 192.168.1.28 host 255.255.255.255 eq ssh connect

  vpnuser1_ONLY list extended access permitted tcp vpnpool 255.255.255.0 74.2.23.195 host 255.255.255.255 eq ssh connect

  ............

  enable SVC

  tunnel-group-list activate

  attributes of Group Policy DfltGrpPolicy

  VPN - connections 8

  VPN-idle-timeout 10

  VPN-session-timeout 60

  Protocol-tunnel-VPN l2tp ipsec

  WebVPN

  SVC Dungeon - install any

  time to generate a new key of SVC 8

  SVC generate a new method ssl key

  SVC request no svc default

  internal GroupPolicy1 group strategy

  attributes of Group Policy GroupPolicy1

  VPN - connections 1

  VPN-idle-timeout 9

  VPN-session-timeout 45

  VPN-tunnel-Protocol svc

  Split-tunnel-policy tunnelall

  WebVPN

  SVC Dungeon - install any

  time to generate a new key of SVC 15

  SVC generate a new method ssl key

  client of dpd-interval SVC 30

  dpd-interval SVC 30 bridge

  value of deny message connection succeeded, but because some criteria have not been met, or because of a specific group policy, you are not allowed to use the VPN features. For more information, contact your COMPUTER administrator.

  disable the SVC routing-filtering-ignore

  username vpnuser1 encrypted password xxxxxxx

  username vpnuser1 attributes

  VPN-group-policy GroupPolicy1

  VPN-idle-timeout 6

  VPN-session-timeout 20

  VPN-filter value vpnuser1_ONLY

  VPN-tunnel-Protocol svc

  value of group-lock COMAVPN

  type of remote access service

  tunnel-group DefaultRAGroup webvpn-attributes

  Disable group companyvpn aliases

  type tunnel-group COMAVPN remote access

  attributes global-tunnel-group COMAVPN

  address (inside) vpnpool pool

  address vpnpool pool

  SDI Group-authentication server

  authentication-server-group (inside) SDI

  LOCAL authority-server-group

  Group Policy - by default-GroupPolicy1

  tunnel-group COMAVPN webvpn-attributes

  activation of the Group companyremote alias

  I did anything wrong / missing?

  Thank you

  Yijun

  
  

  First of all, you can set "no nat-control" because once you have relieved of NAT, 'no nat-control' becomes disable anyway. 'No nat-control' is useful if you have no statement of NAT at all on the interface.

  Second, if you can't access the outside inside which is because you must configure the NAT exemption. Not sure if you have configured it.

  Here's the command:

  access-list allowed sheep ip 192.168.1.0 255.255.255.0 192.168.6.0 255.255.255.0

  NAT (inside) 0 access-list sheep

  You can then add all other subnets that are internal to the ACL sheep if you need VPN access.

  Finally, for the error message deny on access-group "OUTSIDE", you would need check if you have configured "sysopt connection VPN-enabled'. If it is disabled, it will also check the "OUTSIDE" interface for VPN traffic.

• VPN traffic via a secondary access provider

  Hello world

  I have been asked by a client to implement this topology:

  

  where:

  ISP 1 is used as primary internet connection.

  2 ISP will be used to connect remote users by IPsec VPN.

  Currently, I'm not looking for the Active/Backup feature, I need to know if I can use both ISP connections (as I've written before) an ISP for the Internet company and the other for the user remote access VPN.

  I read some post where, said, it's possible, but I want to be sure.

  Kind regards

  Jose

  ASA must add the static route in the routing table automatically when the VPN client is connected. So, in general, you don't need to do anything. But if not, you can just manually configure who will forward a VPN client IP packet to ISP2.

  With respect to NAT, in general, VPN traffic must ignore the NAT. You can use "nat (inside_interface_name) 0-list of access ' with an ACL that define the vpn traffic to do so.

• Tunnel VPN ASA 5520 (DMZ + INSIDE) destined for OUTSIDE

  I can't find any reference to anywhere else.

  We have an ASA 5520 to our site HQ (inside the network) with several regional subnets on the DMZ interface.

  We need connectivity VPN Site to Site between the INSIDE and a remote control on the OUTSIDE of the site, as well as between the DMZ subnets and even outside the site. The interface from the OUTSIDE of the SAA must be local VPN endpoint for all tunnels.

  I created a S2S VPN between the INSIDE and the OUTSIDE site and it works great.

  When I create a VPN S2S tunnel between a site of DMZ and even outside the site (using the same settings the and remote, but with a cryptomap different because the local subnet (DMZ) is different from the other inside the subnet, the traffic gets the mapping (show crypto isakmp his) to the same cryptomap that was created for the access to the tunnel from the OUTSIDE) , instead of to the new cryptomap, so remote endpoint deletes it, and traffic also causes SPI incorrect of for the remote endpoint, which makes the original INTERIOR outside OF THE VPN tunnel to fall from time to time.

  Is this a bug?

  I also did a local S2S VPN tunnel configuration test of networks as everything INSIDE and the DMZ. With the help of the wizard VPN S2S leads ASA only to create a NAT rule exempted for the subnet on the INSIDE interface. Can I manually create another tax-exempt NAT rule to the side of the DMZ and use this a S2S tunnel to connect sites inside and DMZ to the remote OFF-SITE in a connection profile?

  I'm building a Rube Goldberg?

  Thank you

  George

  Hi George,.

  It seems you have a situation overlapping it, are you sure that subnets inside did not overlap with the networks from the DMZ?  A package tracer could clarify wha that the ASA is actually sending.

  In addition, you can merge the two interfaces on the same card encryption if you wish, just make sure that the NAT is configured correctly.   For example; Source NAT (all, outside) static...

  It may be useful

  -Randy-

• VPN access to DMZ host

  I went through the forum messages to allow VPN access to a DMZ host but miss me something and hoping another set of new look will see the question.  Basically, need a VPN profile to allow the service provider to a host in the demilitarized zone.  VPN connects but I can't access the host. Here is the config and Yes its an old Pix 515 running version 7.2 (5) - will get new firewall soon.

  Thank you

  Gary

  PIX Version 7.2 (5)

  !

  !

  interface Ethernet0

  nameif outside

  security-level 0

  IP address xxxx 255.255.255.252

  !

  interface Ethernet1

  nameif inside

  security-level 100

  IP 192.168.254.254 255.255.255.0

  !

  interface Ethernet2

  nameif dmz

  security-level 50

  10.1.1.1 IP address 255.255.255.0

  !

  permit same-security-traffic inter-interface

  outside_access_in list extended access permit icmp any any echo response

  outside_access_in list extended access permit icmp any one time exceed

  access extensive list ip 10.254.253.0 outside_access_in allow 255.255.255.0 host 10.1.1.28

  access extensive list ip 192.168.254.0 inside_outbound_nat0_acl allow 255.255.255.0 10.1.1.0 255.255.255.0

  access extensive list ip 192.168.254.0 inside_outbound_nat0_acl allow 255.255.255.0 10.254.253.0 255.255.255.0

  hvac_splittunnel list standard access allowed host 10.1.1.28

  dmz_nat0_outbound list extended access allowed host ip 10.1.1.28 10.254.253.0 255.255.255.0

  IP local pool hvac 10.254.253.1 - 10.254.253.50 mask 255.255.255.0

  NAT-control

  Global 1 interface (outside)

  NAT (inside) 1 192.168.254.0 255.255.255.0

  NAT (dmz) 0-list of access dmz_nat0_outbound

  NAT (dmz) 1 10.1.1.0 255.255.255.0

  static (dmz, outside) xxxxxx 10.1.1.2 netmask 255.255.255.255

  static (dmz, outside) xxxxxx 10.1.1.3 netmask 255.255.255.255

  static (inside, dmz) 192.168.254.0 192.168.254.0 netmask 255.255.255.0

  Access-group outside_access_in in interface outside

  Route outside 0.0.0.0 0.0.0.0 xxxxxxx 1

  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  Crypto-map dynamic outside_dyn_map 20 the transform-set ESP-3DES-MD5 value

  life together - the association of security crypto dynamic-map outside_dyn_map 20 seconds 86400

  Crypto-map dynamic outside_dyn_map 20 the value reverse-road

  map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

  outside_map interface card crypto outside

  ISAKMP crypto identity hostname

  crypto ISAKMP allow outside

  crypto ISAKMP policy 20

  preshared authentication

  3des encryption

  md5 hash

  Group 2

  life 86400

  crypto ISAKMP policy 65535

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  management-access inside

  dhcpd dns 208.67.222.222 208.67.220.220

  dhcpd ping_timeout 750

  !

  dhcpd address 192.168.254.100 - 192.168.254.200 inside

  dhcpd allow inside

  !

  internal group CVC strategy

  attributes of the hvac group policy

  VPN-idle-timeout 30

  VPN-session-timeout 1440

  Split-tunnel-policy tunnelspecified

  value of Split-tunnel-network-list hvac_splittunnel

  hvac xxxx of encrypted password username

  attributes global-tunnel-group DefaultRAGroup

  authentication - server (outer RADIUS) group

  tunnel-group CVC type ipsec-ra

  tunnel-group CVC General attributes

  hvac address pool

  Group Policy - by default-hvac

  tunnel-group CVC ipsec-attributes

  pre-shared-key *.

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  Gary,

  Configure "crypto isakmp nat - t" and test it.

  If it still does not work, please download the following information from the configuration, after connecting the customer:

  1 see the isa crypto his

  2 see the crypto ipsec his

  Kind regards

  SIM.

• WSA issue with MS-OUTLOOK and VPN traffic

  Hi all

  I am facing a problem where

  1. my users are able to access their mail from the web page, but ms-outlook is not able to synchronize e-mail.

  2. our internal user to an external site via VPN, the user is able to establish the VPN connection, but the web page user tries to gain access to via VPN is not available. I can see traffic from the user to WSA in the firewall, but the traffic of WSA is not forward traffic after that.

  Please suggest. As it is new, I needmore helps everyone.

  Run the command grep in WSA CLI to get the corresponding access logs to see the behavior of the ASO at demand management.

  Grep, access connects for a starter, SSH to the ASO and run the following command from the CLI:

  1 Grep
  2. Enter the number of the journal you want to grep: 1 (for accesslogs)
  3. Enter the regular expression to grep: . *.
  4. do you want the search to be case insensitive? : Y
  5. do you want to tail the logs? : Y
  6. you want to paginate output? : N

  Please keep in mind WSA is passively receiving the traffic and please ensure those kind of traffic will be sent to ASO before confirm us that it of a WSA question or not.

• VPN traffic scanned by CSC

  Site2Ste VPN are configured at the branch offices. Traffic Internet goes through the VPN and the main office. Can the module CSC analysis this traffic?

  Concerning

  Remco

  If the traffic is decrypted before/on the ASA, then Yes.

  Concerning

  Farrukh