11-05-2012 08:53 AM
What is the recommended approach to implement the site to site vpn such that only certain types of traffic are allowed. For exmaple, let's say I want the VPN to do the following.
1. allow only active directory and web traffic from site A to B.
2. allow DNS and remote desktop traffic from site B to A.
3. be able to change what traffic is allowed and which direction is allowed in the future (without the need to take down the VPN)
11-05-2012 05:24 PM
I would configure the site-to-site vpn tunnel with the crypto ACL as normal, ie: IP from local subnet to remote subnet.
To restrict the traffic, just apply access-list to the LAN interface of each site to allow only specific access. That way the VPN will always be up, and if you need to change any access/traffic, you can just add or remove access-list on the respective interfaces.
11-06-2012 01:47 AM
I recently had the same issue and decided to use the 'vpn-filter' feature.
Be careful, vpn-filter ACL’s do not behave the same way as interface ACL’s.
These resources helped me:
http://popravak.wordpress.com/2011/11/07/cisco-ios-vpn-filter/
12-16-2012 05:34 PM
It appears the filter method requires VPN tunnel to reset before changes to ports allowed/denied take affect. The acl method doesn't require reset, is this right?
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide