cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
279
Views
0
Helpful
3
Replies

ASA rule to not bypas ACL's over VPN

whiteford
Beginner
Beginner

Hi,

I have a new ASA and have connected a VPN, it seems to not care about any ACL's I put on then I remember there is a command I can add so VPN's use ACL's, what is this?

Thanks

3 Replies 3

Todd Pula
Rising star
Rising star

Are you referring to not having to add VPN related protocols to an ingress ACL applied to the outside interface? If so, you are more than likely referring to the "sysopt connection permit-vpn".

cmcbride
Beginner
Beginner

Right, that is the normal configuration. In 8.x and maybe 7.x there is a command 'vpn-filter' which can be set per group-policy and reference an ACL. That ACL will be imposed on inbound traffic and outbound traffic.

Alternately you have to disable the 'sysopt connection permit-ipsec' (or 'permit-vpn' for 8.x), and then create an ACL that you apply to your outside interface to allow IPSec traffic connections, but filter access to internal systems.

Using the vpn-filter command is MUCH easier though.

Thanks, "sysopt connection permit-vpn" was the one I used.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers