My question is how we allow VPN traffic via the outside interface but block internet traffic that happens to have the same source address as the remote VPN network ? If you disable the bypassing of interface access lists on an ASA using the "no sysop...