site to site vpn - allow only certain types of traffic between site

[tachyon05]

What is the recommended approach to implement the site to site vpn such that only certain types of traffic are allowed.  For exmaple, let's say I want the VPN to do the following.

1. allow only active directory and web traffic from site A to B.           

2. allow DNS and remote desktop traffic from site B to A.

3. be able to change what traffic is allowed and which direction is allowed in the future (without the need to take down the VPN)

[Jennifer Halim]

I would configure the site-to-site vpn tunnel with the crypto ACL as normal, ie: IP from local subnet to remote subnet.

To restrict the traffic, just apply access-list to the LAN interface of each site to allow only specific access. That way the VPN will always be up, and if you need to change any access/traffic, you can just add or remove access-list on the respective interfaces.

[craig.corbett]

I recently had the same issue and decided to use the 'vpn-filter' feature.

Be careful, vpn-filter ACL’s do not behave the same way as interface ACL’s.

These resources helped me:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00808c9a87.shtml

http://popravak.wordpress.com/2011/11/07/cisco-ios-vpn-filter/

[tachyon05]

It appears the filter method requires VPN tunnel to reset before changes to ports allowed/denied take affect. The acl method doesn't require reset, is this right?