How to Configure One Way Site-to-Site VPN (ASA 5520)

Unanswered Question
Jul 20th, 2010
User Badges:

I have an ASA 5520 and want to setup a L2L VPN tunnel so I can send port 21 traffic to another company, but I do not want them to come back threw the tunnel. I usually use the ASDM to setup site-to-site VPNs. Can I setup the L2L and edit the crypto map for the VPN and choose Originate only? If not, what is the best way to accomplish this. Thanks for the help!

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
bwallander Tue, 07/20/2010 - 10:56
User Badges:

Originate-only would help ensure that you're the only side who can technically bring up the tunnel, however once the VPN is established the other side will be able to send traffic to your side as well until expired or torn down.

I would suggest either using a vpn-filter in the group-policy or try disabling the permit-ipsec sysopt and filter the traffic with an inbound ACL on the interface where your crypto map is applied (probably 'outside'). My concern with FTP however is knowing which ports to specifically open if passive FTP is used. Using the later method may allow the ftp inspect to dynamically permit payload traffic, but I've never tried in that scenario.


This Discussion