DMVPN and inbound access-list

[mohammed.ibrahim]

I was testing a DMVPN scenario with CBAC and inbound access-list. The inbound access-list is applied on the outside physical interface. I found that I had to allow gre traffic on the outside access-list for the DMVPN to work properly.

I am aware that Routers check input access-list twice once before decryption and once after decryption.

But in DMVPN the tunnel 0 terminates the ipsec connection and not the outside interface. There is no reason I have to allow gre on the outside interface. Yet I had to. Has any one else run into the same issue

In Pix you have sysopt connection permit-ipsec to suppress this behaviour (access-list checked twice) for vpn traffic. Do we have something equivalent in IOS.

[ehirsel]

Please post the relvant parts of your config here.

Usually the tunnel 0 terminates the GRE, but not IPSec; Is the crypto map is applied to tunnel 0?

I believe that as far as IOS is concerned, inbound means not only inbound as far as the line is concerned (traffic on the phy interface) but it also means inbound as in inbound to the queue from any source, even a logical interface or a tunnel in the router itself.

I'll review the config and let you know what I find.