What is the recommended approach to implement the site to site vpn such that only certain types of traffic are allowed. For exmaple, let's say I want the VPN to do the following.
1. allow only active directory and web traffic from site A to B.
2. allow DNS and remote desktop traffic from site B to A.
3. be able to change what traffic is allowed and which direction is allowed in the future (without the need to take down the VPN)
I would configure the site-to-site vpn tunnel with the crypto ACL as normal, ie: IP from local subnet to remote subnet.
To restrict the traffic, just apply access-list to the LAN interface of each site to allow only specific access. That way the VPN will always be up, and if you need to change any access/traffic, you can just add or remove access-list on the respective interfaces.
I recently had the same issue and decided to use the 'vpn-filter' feature.
Be careful, vpn-filter ACL’s do not behave the same way as interface ACL’s.
These resources helped me:
It appears the filter method requires VPN tunnel to reset before changes to ports allowed/denied take affect. The acl method doesn't require reset, is this right?