What is the ACL process flow regarding IPSec?

[jkrawczyk]

Can anyone supply me with the order of operation of ingress access lists, specifically regarding IPSec?

I realize that the first thing that is done is the IPSec (isakmp / esp) packet is checked against the ACL (ip access-group 120 in). Then this packet is decrypted and the encapsulated packet is once again checked against this ACL, in my case 120.

Why I need to fully understand this process is because I am not including the encapsulated RFC 1918 addresses in my ACL 120 statement, but my remote site has no problems accessing my network through this VPN.

Regards

Jeff

[paddyxdoyle]

Jeff,

Have a look at the following link.

Although its for NAT it does show IPSEC and it also proves that your findings above are correct.

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080133ddd.shtml

HTH

Paddy

[a.alekseev]

inbound acl is checked twice for a router

For PIX if we have "sysopt connection permit ipsec"

inbound acl isn't checked.

if we have "no sysopt connection permit ipsec"

inbound acl is checked for decrypted traffic.