3.13 Ensure VPN traffic goes through the relevant ACL


By default, the traffic going through IPSEC tunnel (policy-based) bypasses the ACL of the interface the VPN terminates on, often the outside ACL.


VPN are used to interconnect sites, whether intra or inter companies. In many cases, these are seen to extensions of the local network and very little filtering is applied. It is important to consider that a remote site should not be seen automatically as fully trusted but that some level of filtering should be applied, for example to prevent access to local management ports.



Step 1: determine on which interface(s) the IPSEC tunnel ends

Step 2: determine the ACL applied to the interface

Step 3: add an ACE to the ACL to permit the traffic temporarily

Step 4: disable the bypass

Step 1

hostname# show run full | grep crypto.map..*.interface.
crypto map my_remote_sites interface outside

In this example, the crypto map my_remote_sites is applied to the interface outside: the IPSEC tunnel terminates on the interface outside.

Step 2

hostname# sh run access-group | grep interface.outside
access-group outside_acl in interface outside

The ACL outside_acl is applied to the interface outside.

Step 3

Note: this considers that the remote site networks are defined in an object called obj-remote-site and the local site networks in an object called obj-local-site. The ACE is added as the first entry in this case but could be after an initial series of denies to known 'bad' destinations.

hostname(config)# access-list outside_acl line 1 permit ip object obj-remote-site object obj-local-site log notifications
hostname(config)# access-list outside_acl line 2 remark Temporary permit from remote site. Restrict as soon as possible.

Step 4

hostname(config)# no sysopt connection permit-vpn

Default Value:

Disabled by default

See Also


Item Details


References: 800-53|CA-3, 800-53|CA-9, 800-53|CM-2, 800-53|CM-7b., CSCv7|9, CSCv7|11.1, CSCv7|11.2

Plugin: Cisco

Control ID: 4f77782006a16e70432b6fb8d4f8cbfe00e81edeae8f2e5ee94749db43994c70