cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1466
Views
0
Helpful
3
Replies
Highlighted
Beginner

site to site vpn - allow only certain types of traffic between site

What is the recommended approach to implement the site to site vpn such that only certain types of traffic are allowed.  For exmaple, let's say I want the VPN to do the following.

1. allow only active directory and web traffic from site A to B.           

2. allow DNS and remote desktop traffic from site B to A.

3. be able to change what traffic is allowed and which direction is allowed in the future (without the need to take down the VPN)

3 REPLIES 3
Cisco Employee

site to site vpn - allow only certain types of traffic between s

I would configure the site-to-site vpn tunnel with the crypto ACL as normal, ie: IP from local subnet to remote subnet.

To restrict the traffic, just apply access-list to the LAN interface of each site to allow only specific access. That way the VPN will always be up, and if you need to change any access/traffic, you can just add or remove access-list on the respective interfaces.

Explorer

site to site vpn - allow only certain types of traffic between s

I recently had the same issue and decided to use the 'vpn-filter' feature.

Be careful, vpn-filter ACL’s do not behave the same way as interface ACL’s.

These resources helped me:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00808c9a87.shtml

http://popravak.wordpress.com/2011/11/07/cisco-ios-vpn-filter/

Beginner

Re: site to site vpn - allow only certain types of traffic betwe

It appears the filter method requires VPN tunnel to reset before changes to ports allowed/denied take affect. The acl method doesn't require reset, is this right?