Port specifying ACL for PIX's IPSEC

[northowl]

We just want to open for every customer with their VPN connection to our service one and only one tcp port (an ip address is the same always).

The guide for PIX is saying that specifying a port in a VPN access-list we can

decrease performance.

I just wonder how much is it ?

Does anybody have experience with it ?

Thank you.

[ssoberlik]

I am encrypting only Telnet traffic to my remote PIX for remote management and things seem to be working fine but it seems that if you have a large number of peers or clients whose access you are trying to restrict, specifying ports in the crypto access list will stress out your PIX. I don't remember coming across an exact figure but I guess it's bad enough to justify use of the term 'severely degrade' in one of the documents I read some time ago.