we have 2 routers connected to each other via an IPSec tunnel. Both routers are on private networks so there is no natting going on.
The IPSec tunnel is fine and traffic is flowing between the local networks (crypto map/access lists are fine) via the tunnel.
I know I need to secure the outside interface but unsure what sort of ACL is needed so that only IPSec traffic is allowed both in and out and no other traffic enters/leaves the router unless it is via the IPSec tunnel.
Yes, the routers are on private subnets as they are internal routers. This particular one requires IPSec between the endoints to secure the traffic so basically all traffic from the lan needs to go through the vpn with nothing going through the outside interface.
yes I applied an ACL for IPSec on the outside interface in the IN direction and it appears to be working. All other lan traffic is listed as interesting traffic for the vpn.
Is this enough to prevent any traffic leaving the router unencrypted?