ACLs and l2TP connection question

[Leiocalyx]

Hello everyone.

I am trying to better understand how Cisco ASA VPN connections work.

I have an address pool for l2tp ipsec vpn connections to use. The clients can connect to the vpn (on the Outside interface) and get an address from this pool which is okay.

My questions are:

When a client connects, which ACLs are active for that connection?

Is the connected client considered to be part of the Outside interface?

Should I use General ACLs? (because it seems that interface ACLs don't have any effect)

ASA 5508, 9.9(3) if that makes any difference.

[Rob Ingram]

Hi,

With the command sysopt connection permit-vpn which is enabled by default, interface ACLs will be ignored for traffic traversing the VPN tunnel, therefore permitting all traffic over the VPN tunnel.

You should look to implement VPN FIlter, more information here and here.

HTH