ASA Site-to-site Filtering Web Traffic

Unanswered Question
Dec 24th, 2009
User Badges:
We have a Site-to-Site VPN set up with one of our clients. We both need access to an internal website each others network.  I am trying to set up a filter to only allow port 80 both ways.  When I apply a filter only allowing port 80, I also have to open up a range of TCP port.  Why and how to get around opening up range of TCP ports. 
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)


Are you saying that the only traffic that you want to open the Site-to-Site tunnel is traffic to and from each others WebServer on port 80?  I don't understand what Range of TCP ports you are referring to?

If there are no other addresses (networks) used for settting up the site-to-site tunnel you could in essence change the interesting traffic ACL associated to your Tunnel.


access-list VPN-Hq2Remote ext permit tcp gt 1024 host eq www

AT Remote Site

access-list VPN-Remote2Hq ext permit tcp gt 1024 host eq www

Hope this helps,


Kurt Weeks Mon, 12/28/2009 - 06:02
User Badges:


Web Serve

Users      192.168.30.X

Remote site

Web Server

Users    10.10.15.X

Current tunnel

Allow only And  to\16

ACL's I'm trying to build. 

Allow to www

Allow to www

Deny all other traffic

The problem is that this allows the traffic to go over, but it block the connection coming back from the web server.  The only solution I have found it to open a range of TCP coming back from the web server address. 


This Discussion