Cryptomap or VPN filter

[Phil Bradley]

Just curious on best practices when using cryptomaps. Is it recommended to add a complete network and use VPN filters to only allow certain hosts/ports or do this at the cryptomap level? The reason that I ask is that I was experiencing ipsec tunnel issues between an ASA and a Cradlepoint router when using cryptomaps to segment the traffic. If I had 5 hosts or networks defined in the cryptomap, then occasionally the cradlepoint would drop one or two of the ipsec tunnels and I would have to disconnect the VPN to get them to come back up. I finally just added a single network in the cryptomap on both ends and used VPN filters to only allow certain hosts/ports in. So far the single tunnel has stayed up.

[Philip D'Ath]

For site to site VPNs, I tend to put everything in the access list.

[Francesco Molino]

Hi

For L2L, I put the host IP in the crypto acl and use vpn-filter if i want to authorize only few ports on the host.