PIX VPN Client ACL problem

[gokada]

I have a PIX 506e that terminates VPN Clients. Using the Cisco example (nat 0 access-list 80) does not provide for port/protocol mapping. Do you know any way that we can protect our inside resources by defining host-to-host/port-to-port protocol mapping?

Here's what I get:

Firewall(config)# nat (inside) 0 access-list 80

WARNING: access-list protocol or port will not be used

How can I be able to specify protocols as well as ip's?

[llascare]

The "nat 0 access-list 80" command is only used by the PIX to bypass NAT for the VPN traffic. If you dont have any other VPN configurations, then remove the "sysopt connection permit-ipsec" command, and add inbound access lists on the outside interface, in order to allow/deny certain ports.