Policy Based IPSEC Tunnel With Firepower

[TrashPanda]

If I am configuring an IKEv1 IPSEC site-to-site VPN with an FTD device running 7.4.1 managed by the FMC and it is policy based, not route based, does the system ACL applied to the device also control the traffic across the tunnel? If so, then what Zone does the traffic show up as? Currently the device has an Inside and Outside zone defined.

[MHM Cisco World]

Control plane ACL effect only VPN outer header' i.e. it allow or not VPN between FTD and peer

ACP not effect traffic pass via vpn if you enable sysopt permit-vpn' But it effect if disable it.

There is option to tune filter the traffic pass via vpn va traffic filter 

I think it appear in 

Vpn topolgy > advanced > ipsec > filter 

(Fmc)

MHM

[TrashPanda]

If the ACP is seeing the tunnel traffic then what is the source zone? 

[MHM Cisco World]

if you want to config ACP then you need ACP for two direction
ACP Inside->Outside
ACP Outside->Inside 

MHM

[Marius Gunnerud]

for inbound traffic from the remote VPN site you would have a source zone of the outside interface.