How to allow connections in one direction over IPSEC tunnel

Unanswered Question
Apr 6th, 2007


I have a customer who wants to connect 4 locations with IPSEC tunnels in a full mesh using ASA 5505's. The catch is that hosts in locations A, B and C are trusted but location D is a partner location so the hosts are not fully trusted. The customer would like hosts in A, B, or C to be able to initiate connections to any host in location D but not allow hosts in location D to initiate connections to anyone in locations A, B or C.

These are all small sites so the ASAs will be the only devices available.

Does anyone have suggestions how I can accomplish this?


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Jon Marshall Fri, 04/06/2007 - 07:10


Do you have control over site D VPN device ? If so just create an access-list denying traffic from D to A, B or C and apply in on the inside interface of site D device.

If you don't you could apply access-lists in an outboudn direction on A, B & C ASA devices denying site D traffic.



kseraphine Fri, 04/06/2007 - 07:48

Thanks for the reply.

I do have control over site D.

Will that still allow the return traffic for connections initiated from sites A, B and C through?

Jon Marshall Sun, 04/08/2007 - 08:49


Yes it will because the ASA is a stateful firewall. So traffic intiated from site D will be dropped. Traffic returning from site D in response to a connection initiated from one of the other sites will still work.




This Discussion