Blocking remote network - site-to-site vpn

[Lentini32]

Hello,

I have a site-to-site VPN already established, everything is working as it should.  I'm trying to block the remote network from accessing our network since we only need to access theirs.  I'm sure this is something very easy to implement with an ACL but I'm not sure where this rule needs to go. The VPN is on ASA 5505. 

Example:

Site A - Local Network - 1.1.1.0/24

Site B - Remote Network - 2.2.2.0/24 - want to block this network from access local

Any help or guidance would be appreciated.

Thanks in advance,

-j

[Jennifer Halim · Accepted solution]

You are right.. ACL is the easiest way to go.

You can configure ACL in the outbound direction of the internal interface as follows:

access-list inside-acl-out deny ip 2.2.2.0 255.255.255.0 1.1.1.0 255.255.255.0

access-list inside-acl-out permit ip any any

access-group inside-acl-out out interface

With the above ACL, it will block all traffic originating from the remote VPN network outbound towards the internal interface while allowing everything else (eg: originated from other interfaces of the ASA) to originate connection towards the internal network.

Hope this helps.

[Lentini32]

Jennifer,

Thank you very much for the detailed reply.  I'll give it a try.

Again, thanks.

-j

[Jennifer Halim]

Cheers, let us know how it goes.

[Lentini32]

Looking good so far =)  Thank you!

[Jennifer Halim]

Excellent, thanks for the update. Please kindly mark the post as answered so others can learn from your post. Thank you.