VPN's on PIX and the sysopt command

[robin]

I have set up a VPN between 2 PIX firewalls and it works fine but I have a problem with the sysopt connection command which assumes you explicitly trust all traffic from the other network which may not be the case.

Is there any way of filtering traffic per ipsec policy or how do you set up a vpn without this command? (all the sample configs use it).

Thanks in Advance,

Robin

[rrbleeker]

You can set an access-list with networks that are allowed to pass the VPN connection. By using the 'crypto map <#> match address ' it will be related to the VPN session of your choice.

The other side of the connection requires a similar (but mirrored) access-list.

I hope this answers your question.