topic Re: ASA VTI interfaces and access rules in Network Security

ASA VTI interfaces and access rules

Aaron Street — Fri, 21 Feb 2020 14:56:34 GMT

Hi,

Can you add Access Rules to A VTI interface in ASA 9.8?

I see the tunnel interface showing as up in the ASDM, and I can ping the end points from the CLI, but when I chose "Add access rule" in the ASDM the list of interfaces does not include my tunnel?

Aaron

Re: ASA VTI interfaces and access rules

Bogdan Nita — Tue, 12 Dec 2017 15:14:49 GMT

You should be able to add an ACL to the VTI interface.

You could try applying the ACL via CLI:

access-group ACL-VTI-IN in interface VTI

"• Access list can be applied on a VTI interface to control traffic through VTI."
https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/vpn/asa-97-vpn-config/vpn-vti.pdf

Re: ASA VTI interfaces and access rules

MarcBrechbuehl — Fri, 15 Dec 2017 10:21:16 GMT

Great hint, much appreciated! This works for me. After aplying access-group to VTI Interface via CLI and refreshing the ASDM the access-list is also displayed in the GUI and can be modified as usual. But the Interface is still not available if you want to add an new entry - you still need the CLI.

Cheers

Katrin

Re: ASA VTI interfaces and access rules

Aaron Street — Fri, 15 Dec 2017 11:59:44 GMT

Hi,

I did add an ACL to the interface via the CLI, but I still can't add rules to the ACL via the access rule GUI interface? I assume this is a limitation of VTI interfaces.

Seems the ASDM does not recognize VTI interfaces in this way

Re: ASA VTI interfaces and access rules

Aaron Street — Fri, 15 Dec 2017 12:01:03 GMT

MArc, you can use the ACL manager to add rules to the Accees list once it is applied to the interface. rather than use the CLI

Re: ASA VTI interfaces and access rules

john.colet@intact.net — Sun, 15 Dec 2019 08:57:50 GMT

did you create your access-group?

first you want to make sure to create your ACL first, then create the access-group

creating access-group before the ACL will not work. it is part of the cisco mechanics.

there is no limitations for the VTI in terms of ACL,

try this:

access-list nameif-VTI_in deny ip any any

access-group nameif-VTI_in in interface VTI-Interface