11-05-2012 08:53 AM
What is the recommended approach to implement the site to site vpn such that only certain types of traffic are allowed. For exmaple, let's say I want the VPN to do the following.
1. allow only active directory and web traffic from site A to B.
2. allow DNS and remote desktop traffic from site B to A.
3. be able to change what traffic is allowed and which direction is allowed in the future (without the need to take down the VPN)
11-05-2012 05:24 PM
I would configure the site-to-site vpn tunnel with the crypto ACL as normal, ie: IP from local subnet to remote subnet.
To restrict the traffic, just apply access-list to the LAN interface of each site to allow only specific access. That way the VPN will always be up, and if you need to change any access/traffic, you can just add or remove access-list on the respective interfaces.
11-06-2012 01:47 AM
I recently had the same issue and decided to use the 'vpn-filter' feature.
Be careful, vpn-filter ACL’s do not behave the same way as interface ACL’s.
These resources helped me:
http://popravak.wordpress.com/2011/11/07/cisco-ios-vpn-filter/
12-16-2012 05:34 PM
It appears the filter method requires VPN tunnel to reset before changes to ports allowed/denied take affect. The acl method doesn't require reset, is this right?
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: