Hi,
I havent tested a situation exactly as yours but I'd assume the reason why the configuration is failing is because to my understanding the ASA passes all VPN traffic past the interface ACLs.
I've always imagined this would only mean that it passes the outside interface access-list and not the access-lists attached to the outgoing interface of the actual connection (in your case the "inside" interface). But if the connections are indeed going through still, I guess the situation must be that the ASA passes all VPN traffic past ASA interface access-lists.
You got atleast a couple of options
- You can issue "no sysopt connection permit-vpn"
- This will check every connection taken from behind the VPN connection to your OUTSIDE interface access-list.
- So if you for example have L2L VPN and Client VPN, you will have to open the traffic using the remote IP addresses EVEN if they are private IP addresses. Every connection taken from behind VPN must have a permitting access-list rule.
- You SHOULD/MUST make access-list rules to your existing VPNs before issuing this command as otherwise they will start to get blocked by your OUTSIDE interface access-list (I assume you got somekind of access-list attached to OUTSIDE interface with the direction "in")
- You can create a VPN filter access-list
- This access-list will be attached to your VPN connection of choice. It will only apply to traffic on that VPN connection and wont affect the ASAs rules otherwise. ( I can give you an example configuration if you tell me what connections should be allowed from INSIDE -> VPN and VPN -> INSIDE)
Please let me know which solution you think would suite you best or ask more questions.
- Jouni
