Site-to-Site VPN (Limited access to 10 IPs)

[userice]

We have a site to site VPN (two PIX 501). What should I do so the other side can access 192.168.2.10~19, but nothing else.

 

[brianinms]

Change the crypto acl to only specify those hosts.

 

[userice]

can you give me any example?

 

[userice]

We have a site-to-site VPN. I want restrict access over VPN. At this time, We don't need port restrictions

Location1:
outside IP: 205.246.1.x
users at location 2 allow to access 192.168.1.25~26 at location 1

Location2:
outside IP: 76.87.6.y
users at location 1 allow to access 172.22.1.10~30 at location 2

 

[brianinms]

You have an access-list that specifies the traffic to be encrypted and it is located in the crypto map.

object-group network VPN-Host
network-object host 192.168.1.25
network-object host 192.168.1.26

object-group network VPN-Remote
network-object host 172.22.1.10
network-object host 172.22.1.22
*and so on

access-list VPN permit ip object-group VPN-Host object-group VPN-Remote