I have a policy NAT configured from our compnay to another company an it is working fine.

My device is 10.1.150.1

NATed to 10.9.0.3

Their device is 10.1.15.3

Everything works fine through the VPN tunnel when configured this way:

access-list NO_NAT line 2 extended deny ip host 10.1.150.1 host 10.1.15.3

static (inside,outside) 10.9.0.3 access-list yourcompanytranslation3

access-list yourcompanytranslation3 line 1 remark Next line is for yourcompany ATM Policy NAT

access-list yourcompanytranslation3 line 2 permit ip host 10.1.150.1 host 10.1.15.3

crypto map mycompany 30 match address yourcompany

crypto map mycompany 30 set peer 12.1.7.160

crypto map mycompany 30 set transform-set 3dessha

crypto map mycompany 30 set security-association lifetime seconds 3600

access-list yourcompany line 1 extended permit ip 10.9.0.0 255.255.255.248 host 10.1.15.3

The remote end has some appications that my end will be using in the future to additional addresses. I would like to filter the traffic to make sure we are only allowing outbound traffic that is needed.

My question is

Do I filter the traffic on the traffic on the translation access-list:

access-list yourcompanytranslation3 line 1 remark Next line are for yourcompany ATM Policy NAT

access-list yourcompanytranslation3 line 2 permit ip host 10.1.150.1 host 10.1.15.3 eq 5202

access-list yourcompanytranslation3 line 3 permit ip host 10.1.150.1 host 10.1.10.223 range 3464 3467

Or do I filter it on the access-list applied to the crypto map:

access-list yourcompany line 1 extended permit ip 10.9.0.0 255.255.255.248 host 10.1.15.3 eq 5202

access-list yourcompany line 2 extended permit ip 10.9.0.0 255.255.255.248 host 10.1.10.223 range 3464 3467