Internal/Private Site-to-Site VPN - 3825/2821

[fintheman]

I've been pouring over a lot of documentation but I think I have a tricky one here.

I have my main branch router (3825) and two remote routers (2821's).  They are connected through leased lines that do not touch the internet.  For various security reasons I have to ensure that the traffic from the remote's are encrypted in a VPN tunnel even though it is still part of a private network.

I have went ahead and created the tunnels and I can verify that they are up.  I have applied the cryptomap to the correct interfaces, etc.,.

So the question is - How do I ensure that traffic is not just being router out of the interface from the remote sites back to the branch router with or without using the VPN tunnel?  I've taken down the tunnels and of course, the traffic is still being passed back and fourth.

[Marcin Latosiewicz]

Hi,

So the point is to make sure that we're not routing traffic out in cleartext?

The easiest way it to apply access-groups to interfaces on which the routers are communicating.

If all traffic is to be encrypted the interfaces should only allows UDP/500 (and if needed udp/4500) and ESP (or AH) traffic.

Topology info and some more background could be helpful :-)

Marcin