Hi,
I would have to agree with Karsten with regards to the Crypto ACL.
Even though that way of configuring the ACL is more specific, its very much likely to cause problems and missmatches with the L2L VPN configuration between the peers.
Then again especially in the case of L2L VPN the VPN Filter ACLs are pretty confusing at times and they dont quite work with the same logic than the usual ACLs. This is because a single Filter ACL line works for traffic in both direction. So it potentitally opens something that you dont want to open.
I would suggest a different approach
- Configure your L2L VPN Crypto ACLs with all the hosts/subnets that you might require to communicate with eachother
- disable the "sysopt" setting that permits all VPN traffic to bypass your "outside" interface (whatever it might be named) ACL
- Now you can allow or deny all L2L VPN traffic as you would do for normal Internet traffic. Even though it might bloat the ACL I think it keeps the setup easier to manage and there arent many ACLs to keep track of.
Naturally the above setup would require to go through the whole setup and depending on current setup might require too much work for one to start changing to it. I just have found it to be pretty easy to manage and really straightforward approach to controlling VPN traffic for both Clients and Sites.
Most other environments that I manage have a totally separate VPN device. VPN user connections are also controlled at the actual firewall device (different from the VPN device) for all the VPN traffic
- Jouni
