We're implementing a web-proxy service and in the tunnel config over to their service the provider requested a crypo ACL as follows:

access-list outside_30_crypto extended permit ip any any

For the test though we only want one machine's traffic to be pushed through this tunnel. I was told there is a way to limit the tunnel traffic with an additional ACL, but I'm unclear as to how to achieve this and still allow all other traffic through the outside interface as usual.


I would not recommend putting an ACL on a VPN interface (physical or logical source)/tunnel interface(if you are using the newer transport mode configuration) to restrict the traffic thru a VPN. You should modify your ACL for the VPN in a similar manner to what I have posted on your other question Efficient crypto ACL's?

If you wish to send the traffic from just one host thru a VPN, your ACL should have that host's IP as the source address, and whatever remote resources you would like that host to access as the destination address/network. I.e. If your host is and he will be sending traffic to Microsoft Azure cloud network with the LAN addressing being, you would need the ACL to look like the following

permit IP host
  • We're on the same page and given your other (good) answer in the other question, I am confident that I know how to do this if needed, barring the horrible suggestion from our vendor partner. Thanks for your help on both questions.
    – A L
    Jan 14 '14 at 21:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.