300-730 · Question #180
Which command is configured Cisco ASA to allow packets from an IPsec tunnel and the payloads to bypass interface ACLs on the firewall?
The correct answer is B. sysopt connection permit-vpn. The sysopt connection permit-vpn command on Cisco ASA globally allows decrypted IPsec VPN traffic to bypass interface ACL checks, preventing VPN payloads from being dropped by inbound ACLs.
Question
Options
- Asysopt connection permit-acl
- Bsysopt connection permit-vpn
- Csysopt connection permit-sslvpn
- Dsysopt connection permit-ikev1
How the community answered
(21 responses)- A5% (1)
- B90% (19)
- D5% (1)
Why each option
The `sysopt connection permit-vpn` command on Cisco ASA globally allows decrypted IPsec VPN traffic to bypass interface ACL checks, preventing VPN payloads from being dropped by inbound ACLs.
`sysopt connection permit-acl` is not a valid Cisco ASA command and does not exist in the ASA command set.
`sysopt connection permit-vpn` is the correct ASA global configuration command that instructs the firewall to skip interface ACL evaluation for traffic arriving from an IPsec tunnel; without it, the inbound ACL on the inside interface must explicitly permit VPN decrypted traffic or it will be dropped.
`sysopt connection permit-sslvpn` is not a valid ASA command; SSL VPN access is governed through group policies and connection profiles, not a sysopt bypass command.
`sysopt connection permit-ikev1` is not a valid ASA command; IKEv1 is the control-plane negotiation protocol and has no separate sysopt ACL bypass option.
Concept tested: Cisco ASA sysopt command for IPsec VPN ACL bypass
Source: https://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/S/cmdref3/s9.html
Topics
Community Discussion
No community discussion yet for this question.