topic Re: L2L between IOS and ASA in Network Security https://community.cisco.com/t5/network-security/l2l-between-ios-and-asa/m-p/1315725#M765357 <HTML><HEAD></HEAD><BODY><P>Check out the "vpn-filter" command, available in the group-policy.</P></BODY></HTML> Mon, 12 Oct 2009 10:41:15 GMT Herbert Baerten 2009-10-12T10:41:15Z L2L between IOS and ASA https://community.cisco.com/t5/network-security/l2l-between-ios-and-asa/m-p/1315724#M765354 <P>I have L2L connection between ASA and Cisco router. </P><P>I would like to protect traffic and give full access from PIX LAN to some hosts on the cisco router sites but not inversely. </P><P>How to protect the LAN network on PIX site ?</P><P>I couldn't find anything on pix site like tcp established in ACL ? </P><P>On a cisco routers there I can easily configure some access-list in ipsec-isakmp profile ( set ip access-group in| out ) </P><P>thanks in advance for any help</P><P></P> Mon, 11 Mar 2019 16:25:02 GMT https://community.cisco.com/t5/network-security/l2l-between-ios-and-asa/m-p/1315724#M765354 m.michalski 2019-03-11T16:25:02Z Re: L2L between IOS and ASA https://community.cisco.com/t5/network-security/l2l-between-ios-and-asa/m-p/1315725#M765357 <HTML><HEAD></HEAD><BODY><P>Check out the "vpn-filter" command, available in the group-policy.</P></BODY></HTML> Mon, 12 Oct 2009 10:41:15 GMT https://community.cisco.com/t5/network-security/l2l-between-ios-and-asa/m-p/1315725#M765357 Herbert Baerten 2009-10-12T10:41:15Z Re: L2L between IOS and ASA https://community.cisco.com/t5/network-security/l2l-between-ios-and-asa/m-p/1315726#M765358 <HTML><HEAD></HEAD><BODY><P>ok I know about it but where may I controle tcp flags ? </P><P></P></BODY></HTML> Tue, 13 Oct 2009 14:12:26 GMT https://community.cisco.com/t5/network-security/l2l-between-ios-and-asa/m-p/1315726#M765358 m.michalski 2009-10-13T14:12:26Z Re: L2L between IOS and ASA https://community.cisco.com/t5/network-security/l2l-between-ios-and-asa/m-p/1315727#M765359 <HTML><HEAD></HEAD><BODY><P>You cannot control TCP flags - but why would you want to do that in the first place? Note that Pix/ASA is a stateful firewall, not a packet filter.</P><P></P><P>Re-reading your initial question, I think what you want to achieve can be done using "no sysopt connection permit-vpn" and then permitting/denying traffic in the ACL on the outside interface.</P><P>Note however that the outside ACL will apply to all inbound connections over *all* VPN tunnels.</P><P></P><P></P></BODY></HTML> Tue, 13 Oct 2009 19:49:50 GMT https://community.cisco.com/t5/network-security/l2l-between-ios-and-asa/m-p/1315727#M765359 Herbert Baerten 2009-10-13T19:49:50Z