Access-list and IPSec encryption and deceyption

[r.fang]

If I have IP access-list and Ipsec Crypto map being applied to the same router interface, which process happen first? access-list or packet decryption &encryption ?

Thanks

[krishnas]

I think IP access-list is evaluated twice for ingress packets (access-list applied in in direction). It happens for encrypted packet and again for decrypted packet. This is the reason we should explicitly permit isakmp and esp and also traffic after decryption.

For egress traffic, I think outbound access-list is evaluated first followed by encryption.

Hope this helps.

[msdonahue]

please see the link below:

http://www.cisco.com/warp/public/556/5.html

[r.fang]

Thanks, This is the white paper I am looking for.

[krishnas]

I think the packet flow outlined in the above URL is for IOS. On PIX the packets destined to PIX interface don't go through ingress ACL check. In essence, the IPSec packets terminating on the PIX interface don't go through inbound ACL applied on that interface. But after decryption it would go through the ACL if sysopt for ipsec is not configured.