FTP in site to site tunnel

[rodney.adams]

I have a tunnel set up between two pix that allows all traffic to pass. I want to only allow ftp traffic but when I add the appropriate line in my access list it breaks the connection. Any ideas?

[owillins]

Have you tried removing the the "sysopt connection permit-ipsec" command, and using only ACLs to permit traffic. It works sometimes.

[jackko]

by disabling the command 'sysopt connection permit-ipsec', all the vpn traffic will be examined on the outside interface of the pix. thus you will need to configure inbound access list.

access-l xxx permit tcp eq 20

access-l xxx permit tcp eq 21

access-g in inter outside

one thing should be noticed is that you would also need access list for remote vpn and other lan-to-lan vpn.

hope this helps