| 15.5 |  | Using PDM to Create Site-to-Site VPNs |
| 15.5.2 |  | Setting system options |

| To create a VPN using PDM, implicitly permit IPSec packets to bypass PIX Security Appliance ACLs and conduits by selecting Categories > VPN System Options> checking the Bypass access check for IPSec traffic box. System options are used to tune the PIX Security Appliance security features. All of the system options are not enabled by default and must be explicitly enabled. As shown in Figure , the system options pertaining to IPSec are as follows:

- sysopt connection permit-IPSec

- This command enables IPSec authenticated/cipher inbound sessions to always be permitted. Specifying this command in the PIX Security Appliance configuration permits IPSec traffic to pass through the PIX Security Appliance without a check of the conduit or access-list command statements.
- sysopt connection permit-l2tp
- Specifying this command in the PIX Security Appliance configuration permits L2TP traffic to pass through the PIX Security Appliance without a check of the conduit or access-list command statements. Because L2TP traffic can only come from IPSec, the sysopt connection permit-IPSec command allows L2TP traffic to pass as well. To enable this system option, click on the Bypass access check for L2TP traffic check box.
- sysopt connection permit-pptp
- Specifying this command in the PIX Security Appliance configuration permits PPTP traffic to pass through the PIX Security Appliance without a check of the conduit or access-list command statements. To enable this system option, click on the Bypass access check for PPTP traffic check box.
- sysopt IPSec pl-compatible
-The sysopt IPSec pl-compatible command enables the IPSec feature to simulate the Private Link feature supported in PIX Security Appliance version 4. The Private Link feature provides encrypted tunnels to be established across an unsecured network between Private-Link equipped PIX Security Appliances.
- The
sysopt IPSec pl-compatible command allows IPSec packets to bypass the NAT and Adaptive Security Algorithm (ASA) features and enables incoming IPSec packets to terminate on the sending interface. When using the sysopt IPSec pl-compatible command, all PIX Security Appliance features, such as ACL control, stateful inspection, and user authentication, are bypassed for IPSec packets only. If both the sysopt IPSec pl-compatible command and the sysopt connection permit-IPSec command are used within the configuration, the sysopt IPSec pl-compatible command takes precedence. To enable this system option, click on the Bypass PIX NAT and ASA for IPSec traffic check box.