topic asa VPN question in Network Security https://community.cisco.com/t5/network-security/asa-vpn-question/m-p/2087170#M395853 <HTML><HEAD></HEAD><BODY><P>Hello Stuart,</P><P></P><P>You could use Reverse Path Check and take those ACL lines (RFC 1918 addresses.)</P><P></P><P>Now regarding ACL for vpn traffic, by default vpn traffic will not be inspected over the interface ACL's but you can restrict it with any of the interfaces ( remove the syspot permit vpn and that will start inspecting VPN traffic with ACL's)</P><P></P><P>Remember to rate all of the helpful posts</P><P></P><P>Julio</P></BODY></HTML> Thu, 08 Nov 2012 21:34:06 GMT Julio Carvajal 2012-11-08T21:34:06Z asa VPN question https://community.cisco.com/t5/network-security/asa-vpn-question/m-p/2087169#M395851 <P>Hello,<BR />I have several working VPNs between ASAs 8.4 and 8.3<BR />The way this was set up is with cryptomaps that match whole subnets and ACL on the outside interface to permit from/to the RFC 1918 addresses.<BR />I notice that the hit count is zero on these rules and so I wonder if they are actually necessary or doing anything.<BR /><BR />If they are not where can an acl be applied to restrict the VPN traffic? Outbound on the inside interface?<BR /><BR />Sent from Cisco Technical Support iPad App</P> Tue, 12 Mar 2019 00:20:46 GMT https://community.cisco.com/t5/network-security/asa-vpn-question/m-p/2087169#M395851 Stuart Gall 2019-03-12T00:20:46Z asa VPN question https://community.cisco.com/t5/network-security/asa-vpn-question/m-p/2087170#M395853 <HTML><HEAD></HEAD><BODY><P>Hello Stuart,</P><P></P><P>You could use Reverse Path Check and take those ACL lines (RFC 1918 addresses.)</P><P></P><P>Now regarding ACL for vpn traffic, by default vpn traffic will not be inspected over the interface ACL's but you can restrict it with any of the interfaces ( remove the syspot permit vpn and that will start inspecting VPN traffic with ACL's)</P><P></P><P>Remember to rate all of the helpful posts</P><P></P><P>Julio</P></BODY></HTML> Thu, 08 Nov 2012 21:34:06 GMT https://community.cisco.com/t5/network-security/asa-vpn-question/m-p/2087170#M395853 Julio Carvajal 2012-11-08T21:34:06Z