Tunnel interface ignoring inbound access-list

[johan.westberg]

Hi,

I have a 7301 with IOS 12.4 with multipe IPSec/GRE tunnels. My problem is that the inbound access-list (TUNNEL) on the tunnel inteface is ignored completely. Bug ?

Config:

nterface Tunnel0

description IPSEC tunnel to MCTZH

ip address 192.168.223.1 255.255.255.252

ip access-group TUNNEL in

ip tcp adjust-mss 1400

tunnel source GigabitEthernet0/1

tunnel destination 212.72.7.6

crypto map proposal4

brgds Johan

[pengfang]

I guess this case supposed to be GRE over IPSec,not IPsec over GRE.So interteresting traffic sould be defined like this:

permit gre x.x.x.x y.y.y.y

and crypto map applied to physical interface.

[johan.westberg]

Hi,

The GRE/IPSec traffic if flowing just fine, that's not the problem. My issue is that I need to control the traffic inside the tunnel. For instance I would like only to allow smtp and www to come through.

This works fine on other IOS version on other routers but not this brand new 7301. An earlier case (CSCeb47225 )showing the same symptoms has been known in previous releases.

Brgsd Johan Westberg

[lwlaettner]

Speaking with experience with the PIX firewall I know that if the following commmand:

sysopt connection permit-ipsec

is enabled on a PIX then it will ignore the inbound access list if the data is coming through the tunnel. I don't know if routers have this command.

[hramdien]

I got the same problems on 2811 and 1712 routers.

A workaround is, to make a service policy input on the tunnel.

It's a bit of a hassle, but it works fine.

I don't know if cisco wants to solve this issue.

The config would be :

acces-l 100 permit tcp any any eq smtp

class-map match-any xyz

match access-group 100

policy-map Tunnel1_Policy

class xyz

int tunnel1

service-policy input Tunnel1_Policy

[dbroomfield]

In IOS 12.4 Cisco changed the way IPSec tunnels work.

Before you had to put the access list on the interface to restrict what packets came through.

Now you add an access list directly to the crypto map policy.

crypto map mymap 1 ipsec-isakmp

set peer x.x.x.x

set ip access-group 100 <-- Crypto security ACL

set transform-set ESP-AES-SHA

match address 100