https://community.cisco.com/t5/network-security/vpn-filter/m-p/3826133#M6460 <P>Hi,</P> <P>If you have the command <EM><STRONG>sysopt connection permit-vpn</STRONG></EM> (which is enabled by default), then the interface ACLs will be ignored for VPN traffic - thus permitting all VPN traffic by default. If you have the VPN Filter configured, then this ACL will be restricting the traffic.</P> <P>&nbsp;</P> <P>HTH</P> Tue, 26 Mar 2019 09:54:00 GMT Rob Ingram 2019-03-26T09:54:00Z https://community.cisco.com/t5/network-security/vpn-filter/m-p/3825962#M6459 <P>Hello,</P><P>When clients over anyconnect try to access services via ASA, do they use the vpnfilter first or is it the ACL on interfaces that apply first?</P><P>I am confused between vpnfilter &amp; interface ACL ,&nbsp; both are present in our case.</P><P>&nbsp;</P><P>Appreciate all help.</P> Fri, 21 Feb 2020 16:58:50 GMT https://community.cisco.com/t5/network-security/vpn-filter/m-p/3825962#M6459 suthomas1 2020-02-21T16:58:50Z https://community.cisco.com/t5/network-security/vpn-filter/m-p/3826133#M6460 <P>Hi,</P> <P>If you have the command <EM><STRONG>sysopt connection permit-vpn</STRONG></EM> (which is enabled by default), then the interface ACLs will be ignored for VPN traffic - thus permitting all VPN traffic by default. If you have the VPN Filter configured, then this ACL will be restricting the traffic.</P> <P>&nbsp;</P> <P>HTH</P> Tue, 26 Mar 2019 09:54:00 GMT https://community.cisco.com/t5/network-security/vpn-filter/m-p/3826133#M6460 Rob Ingram 2019-03-26T09:54:00Z