Send all traffic thru the vpn tunnel

[jgadbois]

Does anyone know how to send all traffic thru the vpn tunnel on both sides?  I have a EZVpn server on one side and a EZVpn client on the other.  I am not natting on either side.  I am using the default "tunnelall"  for the group policy attributes.  On the client side all traffic, even if not destined for the server side subnet, seems to flow thru the tunnel.  But if I ping from the server side, the same rules don't seem to apply.  Traffic destined for the client side flows thru the tunnel but traffic that isn't gets pumped out the outside interface in the clear.  Which is not cool.

[Parminder Sian · Accepted solution]

Hi,

Traffic from Clinet to server goes through tunnel, this is correct, right ?

Traffic from server to client goes through tunnel, however rest of the traffic does not, right ?

This is working as expected because in ezvpn, the "tunnel all" policy is for traffic that is coming from the client., not leaving the server.

From server side, traffic to client will go through tunnel, rest wont. 

Sian

[jgadbois]

You are absolutely correct. I guess I just assumed that a "policy" was a "policy" and that it applied to both sides.  But....

I was surprised to find that traffic from the server to any subnet other that the client side of the tunnel would come out of the outside interface in the clear.  But I fixed it with an access list on the inside interface.  I would like to take credit for the fix but I called TAC.  Now everything flows the way I want it to.  I block everthing not destined for the client side.  And it works!