topic Re: SITE TO SITE VPN with access-list on the outside interface in Network Security

SITE TO SITE VPN with access-list on the outside interface

jorjes1984 — Mon, 11 Mar 2019 14:35:25 GMT

I need to ask a simple question,

I have a site to site VPN, and it is working properly,

If i want to add an access-list on the outside interface of the firewall for the incoming traffic, does it affect the VPN Traffic? i have to permit anything related to the VPN in the access-list??

Re: SITE TO SITE VPN with access-list on the outside interface

rickyjohnt — Sun, 11 Jan 2009 10:39:54 GMT

you can add the rule , not a problem

Re: SITE TO SITE VPN with access-list on the outside interface

jorjes1984 — Sun, 11 Jan 2009 10:56:23 GMT

Add the rule without adding anything related to the VPN, yah?

Re: SITE TO SITE VPN with access-list on the outside interface

Jithesh K Joy — Mon, 12 Jan 2009 07:10:34 GMT

hi Jorjes,

if you have given "sysopt connection permit-ipsec " in global configuration mode of the device to allow the VPN traffic to bypass interface access lists, none of the access-list at the interface will block your VPN traffic.

Please visit the following url for more info

http://www.cisco.com/en/US/docs/security/asa/asa81/command/ref/s8.html#wp1381414

Thanks

Jithesh K Joy

Re: SITE TO SITE VPN with access-list on the outside interface

akin_lopez — Mon, 12 Jan 2009 11:07:51 GMT

Hi,

Jithesh is right. if you use the command "sysopt connection permit-ipsec " all interface acls will be bypassed by vpn traffic.

if you are using os 7.x and greater, there is a new command under the group policy for each VPN that can effectively filter traffic for each VPN. it is the "vpn-filter" command.

check out the link:

http://www.cisco.com/en/US/docs/security/asa/asa72/command/reference/uz_72.html#wp1411607

regards,