vpn filter

[suthomas1]

Hello,

When clients over anyconnect try to access services via ASA, do they use the vpnfilter first or is it the ACL on interfaces that apply first?

I am confused between vpnfilter & interface ACL ,  both are present in our case.

Appreciate all help.

[Rob Ingram · Accepted solution]

Hi,

If you have the command sysopt connection permit-vpn (which is enabled by default), then the interface ACLs will be ignored for VPN traffic - thus permitting all VPN traffic by default. If you have the VPN Filter configured, then this ACL will be restricting the traffic.

HTH