Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

How to Configure One Way Site-to-Site VPN (ASA 5520)

I have an ASA 5520 and want to setup a L2L VPN tunnel so I can send port 21 traffic to another company, but I do not want them to come back threw the tunnel. I usually use the ASDM to setup site-to-site VPNs. Can I setup the L2L and edit the crypto map for the VPN and choose Originate only? If not, what is the best way to accomplish this. Thanks for the help!

New Member

Re: How to Configure One Way Site-to-Site VPN (ASA 5520)

Originate-only would help ensure that you're the only side who can technically bring up the tunnel, however once the VPN is established the other side will be able to send traffic to your side as well until expired or torn down.

I would suggest either using a vpn-filter in the group-policy or try disabling the permit-ipsec sysopt and filter the traffic with an inbound ACL on the interface where your crypto map is applied (probably 'outside'). My concern with FTP however is knowing which ports to specifically open if passive FTP is used. Using the later method may allow the ftp inspect to dynamically permit payload traffic, but I've never tried in that scenario.