Hi,

thanks for your reply.

btw, as the ACL is configured under the crypto configuration, if crypto fails, will the ACL still apply for the source to destination? or will the router treat the interface as having no ACL and pass all traffic?

Thanks.

Christina

Whether encryption is working or is not working the ACL referenced in the crypto map is only used to determine which traffic should be protected by VPN. The ACL does not affect at all what traffic will go out the interface, it only affects what traffic will be processed by VPN before it is transmitted (or after it is received). So the router always treats the interface as having no ACL and passing all traffic (unless there is a separate ACL applied to the interface).

HTH

Rick

Christina,

As Rick said the failure of the encryption will not affect the traffic passing through the interface but it will definitely affect the encrypted traffic between the source and the destination if failure in the encryption brings down the VPN tunnel itself.

Say for eg your access-list is referencing some private source-destination pairs over the internet VPN, any failure on the tunnel would mean dropping of this traffic.

HTH

Narayan