Thanks so much for your reply. How would I use the tunnel interface? I dont suppose you have any good documentation you could point me to.

Cheers again

Steve

Here is an exemple using virtual tunnel interface, it's very simple

http://www.ciscoblog.com/archives/2006/08/vpn_virtual_tun.html

create a tunnel interface with source/dest pub address, private address, then assign an IPSEC profile for protection (which contains a transform set).

The problem is the other end of the tunnel is not in our control.

The VPN is currently setup using (what I call) the standard VPN setup, therefore I am reluctant, even unsure, as to whether the tunnel interfaces would help us, as we have no shared IP ranges to use as the tunnnel interface IP address.

Also, restricting the traffic on the phase 2 ACL doesnt seem to work. Do you, or anyone else have any other ideas?

Thanks and regards

Steve

Hi, I think you can still use a tunnel interface even if the other end use a crypto map, but that should be tested before.

Other solutions I see would be to put an ACL on the insides interfaces, as once the traffic is tunneled, you won't be able to filter it on the outside if, but you can still modify the crypto acl to cipher only one part of the traffic, and drop it with an outside ACL.

Another solution would be to use PBR to null0 interface for traffic that shouldnt leave by the tunnel.