Yes a site to site VPN would be the best way to set this up.  You can restrict down to just the specific IP of their DC for their system to access and then deny all other traffic to that system.  As for your users, you can allow only specific traffic for data purposes too. This will be the most secure way to get this done.  What kind of ASA do you have and the version of code it is running to give you further assistance in setting this up? Thanks and Cheers! Kimberly Please remember to rate helpful posts. ... View more

Matt, Here is some of the information for this: Network Diagram This document uses the network setup shown here: In this diagram, Router 1 (R1) and Router 2 (R2) are in AS 100, which       has external BGP (eBGP) peering with ISP-A (AS 300) and ISP-B (AS 400)       respectively. Router 6 (R6) is a part of AS 600, which has eBGP peering with       ISP-A and ISP-B. R1. R2 has iBGP peering, which is necessary to ensure optimal       routing. For example, when you try to reach AS 400 internal routes, R1 does not       employ the longer path over AS 300. R1 forwards the traffic to R2       instead. R1 and R2 are also configured for HSRP over a common Ethernet segment.       Hosts on the same Ethernet segment have a default route that points towards the       HSRP standby IP address 192.168.21.10. Configurations R1 Current configuration hostname R1 ! interface serial 0 ip address 192.168.31.1 255.255.255.0 ! interface Ethernet1   ip address 192.168.21.1 255.255.255.0   standby 1 priority 105   standby 1 preempt delay minimum 60   standby 1 ip 192.168.21.10   standby 1 track Serial0 !--- The standby track serial command tracks the state of !--- the Serial0 interface and brings down the  !--- priority of standby group 1, if the interface goes down. !--- The standby preempt delay minimum 60 command makes sure that !--- R1 preempts and takes over as active router again. This command also ensures that !--- the router waits 60 seconds before doing so in order to give BGP time enough !--- to converge and populate the routing table. This avoids !--- traffic being sent to R1 before it is ready to forward it. ! ! router bgp 100   no synchronization   network 192.168.21.0   neighbor 192.168.21.2 remote-as 100   neighbor 192.168.21.2 next-hop-self   neighbor 192.168.31.3 remote-as 300   no auto-summary ! R2 Current configuration:  hostname  R2 ! interface serial 0  ip address 192.168.42.2 255.255.255.0  ! interface Ethernet1  ip address 192.168.21.2 255.255.255.0  standby 1 priority 100  standby 1 preempt  standby 1 ip 192.168.21.10  ! !  router bgp 100  no synchronization  network 192.168.21.0   neighbor 192.168.21.1 remote-as 100  neighbor 192.168.21.1 next-hop-self  neighbor 192.168.42.4 remote-as 400  neighbor 192.168.42.4 route-map foo out !--- It appends AS 100 to the BGP updates sent to AS 400 !--- in order to make it a backup for the ISP-A to R1 path. no auto-summary  !  access-list 1 permit 192.168.21.0  route-map foo permit 10  match ip address 1  set as-path prepend 100  end Verify This section provides information you can use to confirm your       configuration is working properly. Certain show commands are supported by the       Output Interpreter Tool (registered customers only)         , which allows you to view an       analysis of show command output. When you configure redundancy in any network, you must consider two       things: The creation of a redundant path for packets going from a local           network to a destination network. The creation of a redundant path for packets coming back from a           destination to a local network. This information was from the link I gave you.  Thanks and Cheers! Kimberly Please remember to rate helpful posts. ... View more

David, All the Cisco ASAs come with the default 2 user license for AnyConnect/SSL VPN users, but if you want or need more you will need to buy the license to allow for the additional users.  This is true for the existing ASA and the new X series products. Thanks and Cheers! Kimberly Please remember to rate helpful posts. ... View more