Access Rules on ASA 5520 For Site to Site VPN

[Mitesh Manwatkar]

Hi,

I will be setting up a site to site vpn between our two branch offices using ASA 5520 (VPN Gateway) at both locations.

Both of my ASA's outside interfaces are configured with Static Public IP address which I will be using for vpn peer identity.

What kind of access rules do I need to configure on ASA apart from allowing interesting traffic in source and destination field.

Do i need to add rules for udp port 500 or esp traffic if any.

Kindly help with this.

Regards.

[nspasov]

You don't need to permit anything else beside the interesting traffic that is to be encrypted unless:

- The ASA terminating the tunnel is sitting behind another ASA/FW/Router. If that is the case then you will need to create some "permit" entries on that device

- You can an ACL attached on the "outside" that is only allowing the "outside" IP to communicate with a specific list of other public IPs

I hope this helps!

Thank you for rating helpful posts!