Access list for Remote Access VPN in IOS

[arnis]

Hi

I have a router configured with an IOS Firewall and remote access ipsec VPN.

users can connect in fine, but no traffic passes through the VPN tunnel unles I do the following in the outside accesslist

access-list 110 permit ip 192.168.195.0 0.0.0.255 any

192.168.195.0 is the networ assigned to VPN clients, and I have to permit that network all access into the router for this to work.

is this normal, or is there a way to narow it down.

Cheers

Arni

[050878james]

that`s correct, but I would never use "any" config you have used :

access-list 110 permit ip 192.168.195.0 0.0.0.255 any

In my case I have 2 LAN networks :

172.16.0.0 255.255.255.0

10.0.0.0 255.255.255.0

and my vpn clients have the ip pool:

192.168.0.0 255.255.255.0

So I created the ACL as below :

ip access-list extended ACL_CRYPTO_VPN_CLIENTS

deny ip 172.16.0.0 0.0.0.255 192.168.0.0 0.0.0.255

permit ip 10.0.0.0 0.0.0.255 192.168.0.0 0.0.0.255

I denied access to VPN clients on the network 172.16.0.0 and permited them access to network 10.0.0.0.

You see? I have not used ANY because if You later add more than one LAN than is it more easy to handle the ACL, more easier to find out who have and who have not permission to access specified networks.

please rate if this helps

cheers

James