Unidirectional Data Flow Over an IPsec VPN

IPSec VPNs inherently require bidirectional negotiation (IKE/ISAKMP phases) to establish a tunnel. However, it is possible to simulate a unidirectional data flow by controlling the allowable traffic in each direction. There are two potential approaches.

Interesting Traffic with Crypto ACLs

The traffic that should be protected is called Interesting Traffic and can be configured with Crypto ACLs.

On Cisco IOS routers or Cisco ASAs, use crypto access control lists (ACLs) to define protected traffic. For traffic only from Site A to Site B, configure Site A's ACL to match A→B traffic. Although Site B's mirrored ACL (B→A) is technically required for Phase 2, return traffic can be blocked after decryption using an inbound ACL or firewall policy. The tunnel will establish, but B→A data is dropped.

Tunnel Interface with Routing Controls

With a Virtual Tunnel Interface (VTI) on IOS routers, implement routing or static routes over the interface. Apply ACLs or policy-based routing (PBR) to allow traffic only in one direction. This method offers flexibility, treating the tunnel as an L3 interface where IP addresses, ACLs, routing, and firewall rules can be configured similarly to a physical interface.

While IPSec VPNs need initial bidirectional communication for tunnel setup, these measures help achieve selective data flow direction.

https://networklessons.com/security/ipsec-internet-protocol-security

https://networklessons.com/security/cisco-ipsec-tunnel-mode-configuration

https://networklessons.com/security/ipsec-static-virtual-tunnel-interface

https://networklessons.com/security/ipsec-vti-virtual-tunnel-interface