How to Configure One Way Site-to-Site VPN (ASA 5520)
I have an ASA 5520 and want to setup a L2L VPN tunnel so I can send port 21 traffic to another company, but I do not want them to come back threw the tunnel. I usually use the ASDM to setup site-to-site VPNs. Can I setup the L2L and edit the crypto map for the VPN and choose Originate only? If not, what is the best way to accomplish this. Thanks for the help!
Re: How to Configure One Way Site-to-Site VPN (ASA 5520)
Originate-only would help ensure that you're the only side who can technically bring up the tunnel, however once the VPN is established the other side will be able to send traffic to your side as well until expired or torn down.
I would suggest either using a vpn-filter in the group-policy or try disabling the permit-ipsec sysopt and filter the traffic with an inbound ACL on the interface where your crypto map is applied (probably 'outside'). My concern with FTP however is knowing which ports to specifically open if passive FTP is used. Using the later method may allow the ftp inspect to dynamically permit payload traffic, but I've never tried in that scenario.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...