Extended ACLs for VPN in Cisco ASA

[danielmanqui]

Hi
I would like to see how extended access lists are created for a VPN in a Cisco ASA. I have seen several VPN creation tutorials but all of them are standard access lists, I need to change my current standard access lists to extended ones in my VPN / Cisco AnyConnect. What should I keep in mind when replacing these access lists?

sorry for my English.

thanks.

ASA 5525

ASA Version 9.6(3)1

[Sheraz.Salim]

standard ACLs are used when the source network in the traffic is not important. These ACLS are used by processes like OSPF and VPN tunnels (such as anyconnect).

[danielmanqui]

thanks for the reply.
I detail my query:
I have standard ACLS configured in an AnyConnect VPN (site to client), but I want to change it to an extended ACL.
I already made the change but it doesn't work for me, this is an example, with ACL standard works with extended ACL does not work:

works

access-list splittunnel-acl-VPN_USER standard permit host 192.168.76.155

it does not work

access-list splittunnel-acl-VPN_USER-ext extended permit ip any host 192.168.76.155

[Sheraz.Salim · Accepted solution]

as said earlier standard ACLs are used when the source network in the traffic is not important. In anyconnet vpn you always use standard ACL not extended ACL. why you want to put the extended ACL.

works    this works because your source network is not important

access-list splittunnel-acl-VPN_USER standard permit host 192.168.76.155

split tunnel purpose is to push a reverse route to the client, this wont work with a extended acl and actually, even if you define it, it wont solve the purpose. If you wish to define the port restriction, you can use vpn filter:

https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/99103-pix-asa-vpn-filter.html#anc6

[danielmanqui]

Perfect!
That is exactly what I need, to filter services (ports) in the ACLS VPN.
I am very clear your answer, thank you very much.