ASA with ssl vpn with no acl in outside interface

[mahesh18]

Hi everyone,

I have seen one of our clients setup where they have cisco ASA with ssl anyconnect vpn.

on outside interface of vpn asa there is no acl.

Need to know how client traffic is coming from outside world to establish the vpn connections without any permit acl on outside interface?

Regards

Mahesh

[Aditya Ganjoo · Accepted solution]

Hi Mahesh,

The command " sysopt connection permit-vpn" tells the ASA to allow the VPN traffic regardless of access-lists.

Check this link:

http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/99103-pix-asa-vpn-filter.html

Regards,

Aditya

please rate helpful posts and mark correct answers.

[Aditya Ganjoo]

Hi Mahesh,

You can check this config using the following command :

show run all sysopt

Regards,

Aditya

[mahesh18]

here is output 

show run all sysopt
no sysopt connection timewait
sysopt connection tcpmss 1380
sysopt connection tcpmss minimum 0
sysopt connection permit-vpn********************************1
sysopt connection reclassify-vpn
no sysopt connection preserve-vpn-flows
no sysopt radius ignore-secret
no sysopt noproxyarp outside
no sysopt noproxyarp inside
no sysopt noproxyarp management

is the config 1 line will allow user vpn connections on outside interface without any acl?

Regards

MAhesh

[Aditya Ganjoo · Accepted solution]

Hi Mahesh,

Yes you are correct.

Regards,

Aditya

[mahesh18]

Many thanks Aditya.

Regards

Mahesh

[Aditya Ganjoo]

Hi Mahesh,

Happy to help you. :)

Regards,

Aditya