PIX site to site VPN

[j-barrett]

When doing site-site VPN on PIX and using the "sysopt connection permit-ipsec" command does this mean that once de-crypted all traffic will be allowed through.

Every example of PIX site-site I have looked at makes no mention of any access-lists applied to the outside interface when "sysopt connection permit-ipsec" is configured.

I thought once de-crypted the traffic would then need to match an access-list to continue it's journey to a higher security interface.

Please help, I'm confused.

[jasobrown]

You are correct. When using "sysopt connection permit-ipsec" it bypasses all access-list checks. In order to have traffic match acls you need to disable it and include the VPN traffic in you acl on the outside interface.