S2S VPN Tunnels and ACE entries

[keithcclark71]

I was under impression that for S2S tunnel on each side that along with NAT for the tunnel that one has to define firewall rules for remote tunnel access through outside interface to inside interface and that also from the inside interface a rule allowing inside network to remote tunnel network. From what I see it seems that all I need is Inside network to Remote network ? How are access list rules applied to the tunnels?

[Rob Ingram · Accepted solution]

@keithcclark71 on what device, ASA or FTD? On the ASA as default the interface ACLs are ignored. On the FTD you have to explictly permit traffic in the ACP. In your instance if traffic is never initated from remote network to inside, then you do not need to permit traffic as the FTD is stateful, the return traffic will automatically be permitted. However if communication is initated from remote network to inside, then you'd need an ACP rule to permit this traffic.

[keithcclark71]

Thanks Rob , 

The ASA I inherited has at least a hundred rules applied to the outside interface related to remote VPN subnets so whoever did this put in a lot of time for nothing. I was wondering why so many of these had 0 hit counts now it makes sense.

[Alan Inman]

@Rob Ingram that is really good info. What is weird, I have an FTD running 30+ l2l tunnels, and only 3 of them have hit counts. The rest are "0" I jumped in the CLI, and many that show "0" also show the vendor being the initiator, not us. The tunnels work so not overly concerned, but now I'm wondering how they are working.  

[Rob Ingram]

@Alan Inman possibly a bug or traffic is matching another rule perhaps? From the CLI - run "system support firewall-engine-debug", match on the source or destination IP address of the vendor and determine what rule number the connection matches.

[keithcclark71]

How can you tell from the CLI who the initiator is?

[Rob Ingram · Accepted solution]

@keithcclark71 On the ASA, use "show conn detail" and check the flags of a connection - "I" is initiator data.