IPSec VPN tunneled traffic does not require an ACL?

[krzysztofmaciejewskiit]

I tested today the establishment of a Route Based IPsec VPN between the ASA and the FTD.
Everything works fine however I was surprised that on the ASA I didn't have to add a single ACL.
I wonder if traffic destined to the tunnel is treated like traffic from a higher security "zone" to a lower security "zone"?

[Rob Ingram]

@krzysztofmaciejewskiit Access control lists can be applied on a VTI interface to control traffic through VTI. To permit any packets that come from an IPsec tunnel without checking ACLs for the source and destination interfaces, the sysopt connection permit-vpn command is used.

[krzysztofmaciejewskiit]

Thanks for the information, I didn't know about that.
However, in my case there is no this command entered, and still all traffic destined to and from the tunnel passes correctly.

[Rob Ingram · Accepted solution]

@krzysztofmaciejewskiit it's enabled as default, it would only appear in the configuration if it explictly disabled.

ASA(config)# no sysopt connection permit-vpn
ASA(config)# show run | i sysopt
no sysopt connection permit-vpn
ASA(config)#
ASA(config)# sysopt connection permit-vpn
ASA(config)# show run | i sysopt
ASA(config)#

 So if you cannot see it in the configuration it is enabled.

[krzysztofmaciejewskiit]

A very interesting one. Thanks for the helpful reply!

[MHM Cisco World]

Sysop connection not work and not effect route based vpn in FTD (use zone)

You need ACP' or you already use prefilter pass all traffic in ftd

For ASA I think you need it.

MHM

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/216276-configure-route-based-site-to-site-vpn-t.html <<- the note I mentioned above list here.

MHM

[MHM Cisco World]

Check below 

MHM

[Rob Ingram]

---

@MHM Cisco World wrote:

For ASA if you not specify secuirty level then it by defualt set to 100 and I think it same as inside interface.

This with use same secuirty inter will make traffic pass from inside to vti.

Abd hence also sysop no have any effect here.

MHM

---

No actually By default, the security level for VTI interfaces is 0. You cannot configure the security level.

[Rob Ingram]

For ASA if you not specify secuirty level then it by defualt set to 100 and I think it same as inside interface.

This with use same secuirty inter will make traffic pass from inside to vti.

Abd hence also sysop no have any effect here.

MHM

[krzysztofmaciejewskiit]

Yes, on FTD I intentionally allowed this traffic using Access Control. However, on the ASA I did nothing completely, no ACLs or using the sysopt command.

[MHM Cisco World]

I explain why in my second comments' 

Use show interface ip breif check secuirty level.

MHM

[krzysztofmaciejewskiit]

security levels are set manually, zone inside 90, outside 10.

[MHM Cisco World · Accepted solution]

Yes as Mr Rob mention and check vti level is 0 by defualt.

Traffic initiate from asa inside to vti

So from inside 90 to 0 allow by defualt (no need sysop here)

And retrun traffic is allow since it have conn 

For traffic initiate from FTD 

The traffic from 0 to 90 is not allow unless you use sysop (by defualt enable)

The return traffic is allow since it have conn

Thanks to all 

MHM

[krzysztofmaciejewskiit]

All clear and logical.