Controlling VPN client access on pix

[jeffrey.chong]

Does anyone have any idea on controlling VPN client access once they get connected thru VPN (PIX).

I tried using access-list but it does not filter out correct as defined by ports.

[jay_colby]

The sysopt permit Ipsec will overide the acls on the interfaces for your vpn traffic. You will need to take the sysopt out. Then on the outside interface build your ACL to allow isakmp and ESP/AH traffic. Once you do that you can now limit your traffic per ACL on the outside or inside interface. That it is up to you and your security policy.

[carlogon]

i will try to make some acls matchingthe intersting traffic on the inside interface , the sysopt command only overwrites the acl on the outside interface