Vrovpn VPN traffic Filtering

Www.2cto.com purpose: Inside can only access Private www traffic, Private can only telnet Inside. ACL processing process InboundOutboundConfiguration: Inside: interface FastEthernet1/0
Ip address 1.1.1.1 255.255.255.0
Duplex auto
Speed auto
!
Ip route 0.0.0.0 0.0.0.0 1.1.1.10 GW1: crypto keyring cisco
Pre-shared-key address 64.1.1.1 key cisco
!
Crypto isakmp policy 10
Authentication pre-share
Crypto isakmp profile isaprof
Keyring cisco
Match identity address 64.1.1.1 255.255.255.255
!
Crypto ipsec transform-set esp-3des esp-md5-hmac
!
Crypto map cisco 10 ipsec-isakmp
Set peer 64.1.1.1
Set transform-set SET
Set isakmp-profile isaprof
Match address vpn
!
Interface FastEthernet1/0
Ip address 1.1.1.10 255.255.255.0
Duplex auto
Speed auto
!
Interface FastEthernet1/1
Ip address 202.1.1.1 255.255.255.0
Duplex auto
Speed auto
Crypto map cisco
!
Ip route 0.0.0.0 0.0.0.0 202.1.1.10
!
Ip access-list extended vpn
Permit ip 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255 Internet: interface FastEthernet1/0
Ip address 202.1.1.10 255.255.255.0
Duplex auto
Speed auto
!
Interface FastEthernet1/1
Ip address 64.1.1.10 255.255.255.0
Duplex auto
Speed auto GW2: crypto keyring cisco
Pre-shared-key address 202.1.1.1 key cisco
!
Crypto isakmp policy 10
Authentication pre-share
Crypto isakmp profile isaprof
Keyring cisco
Match identity address 202.1.1.1 255.255.255.255
!
Crypto ipsec transform-set esp-3des esp-md5-hmac
!
Crypto map cisco 10 ipsec-isakmp
Set peer 202.1.1.1
Set transform-set SET
Set isakmp-profile isaprof
Match address vpn
!
Interface FastEthernet1/0
Ip address 64.1.1.1 255.255.255.0
Duplex auto
Speed auto
Crypto map cisco
!
Interface FastEthernet1/1
Ip address 2.2.2.10 255.255.255.0
Duplex auto
Speed auto
!
Ip route 0.0.0.0 0.0.0.0 64.1.1.10
!
Ip access-list extended vpn
Permit ip 2.2.2.0 0.0.0.255 1.1.1.0 0.0.0.255 Private: interface FastEthernet1/0
Ip address 2.2.2.2 255.255.255.0
Duplex auto
Speed auto
!
Ip route 0.0.0.0 0.0.0.0 2.2.2.10 added control: GW1: ip access-list extended gw1.inbound
Permit udp host 64.1.1.1 eq isakmp host 202.1.1.1 eq isakmp
Permit esp host 64.1.1.1 host 202.1.1.1
Ip access-list extended gw1.outbound
Permit esp host 202.1.1.1 host 64.1.1.1interface FastEthernet1/1
Ip access-group gw1.inbound in
Ip access-group gw1.outbound outip access-list extended crypto. inbound
Permit tcp 2.2.2.0 0.0.0.255 1.1.1.0 0.0.0.255 eq telnet
Permit tcp 2.2.2.0 0.0.0.255 eq www 1.1.1.0 0.0.0.255
Ip access-list extended crypto. outbound
Permit tcp 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255 eq www
Permit tcp 1.1.1.0 0.0.0.255 eq telnet 2.2.2.0 0.0.0.255crypto map cisco 10 ipsec-isakmp
Set ip access-group crypto. inbound in
Set ip access-group crypto. outbound outGW2: ip access-list extended gw2.inbound
Permit udp host 202.1.1.1 eq isakmp host 64.1.1.1 eq isakmp
Permit esp host 202.1.1.1 host 64.1.1.1
Ip access-list extended gw2.outbound
Permit esp host 64.1.1.1 host 202.1.1.1interface FastEthernet1/0
Ip access-group gw2.inbound in
Ip access-group gw2.outbound out www.2cto.com ip access-list extended crypto. inbound
Permit tcp 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255 eq www
Permit tcp 1.1.1.0 0.0.0.255 eq telnet 2.2.2.0 0.0.0.255
Ip access-list extended crypto. outbound
Permit tcp 2.2.2.0 0.0.0.255 1.1.1.0 0.0.0.255 eq telnet
Permit tcp 2.2.2.0 0.0.0.255 eq www 1.1.1.0 0.0.0.255crypto map cisco 10 ipsec-isakmp
Set ip access-group crypto. inbound in
Set ip access-group crypto. outbound out can only access www, not telnet, not PING

Source http://q3322095.blog.51cto.com/3312095/992149