Does ASA need outside interface config to permit LAN L2L VPN set up?

[jmaxwellUSAF]

Hello.

When erecting an L2L VPN from an internal LAN router, through an ASA, to a remote www device, does anything need to be configured on the ASA outside interface ACL (such as permitting remote IP-address, protocols, ports)?

(It seems to me that the internal LAN VPN endpoint would begin the communication to the remote endpoint, so nothing would need to be configured on the outside interface.)

Thank you.

[MHM Cisco World]

If vpn sysop permit connect is not disable then outside will allow all traffic from vpn s2s

[Rob Ingram]

@jmaxwellUSAF so the VPN is being establish through (either side of) the ASA not to the ASA itself?

In which case assuming the outside interface has a security level of 0 and the other interface (inside ?) has a higher security level, you must explictly permit traffic from outside to inside. For IPsec you need to permit udp/500 and ESP and if NAT in the path you'd need to permit udp/500 and udp/4500.

[jmaxwellUSAF]

You make sense, and I will config accordingly.

Theoretically speaking-- When setting up VPN, both devices are trying to reach eachother, which means at least that the inside LAN device is initiating connection, so why do I need to execute anything on outside interface?

[Rob Ingram · Accepted solution]

@jmaxwellUSAF ok, if the device on the inside of the ASA is initiating the tunnel (from inside to outside) then the return traffic would be permitted, so no you don't need to permit traffic from outside to inside. Obviously if you do not permit inbound on the outside interface the peer would not be able to initiate the VPN.

If you have an ACL inbound on the inside interface you must explictly permit the IPSec traffic. However if you do not have an ACL inbound on the inside interface, then traffic from higher inerface to lower interface would be permitted as default.

[MHM Cisco World]

No need any acl config in outside.