@Clive_A Well, an IPSec configuration can do this since the 7206 has the ability to specify multiple subnets, but the ER605 can't because the option isn't there. I would have thought that the...

@Clive_A Thanks for the reply. It is in fact a site to site, so I can manage devices at both sides internally so IPSec working fine. The utlimate goal is that I want what I just mentioned, which is...

Hello, I have an IPSEC connection setup between a ER7206 & ER605 in the following design. ER7206 (Hub) <-> ER605 (Spoke) Connections work fine to each other to the primary LAN over the IPSEC...

@d0ugmac1 Well, tried this out, and it did not block the traffic during the timeframes with the deny in place. Not sure if this is a bug or if I'm not configuring it correctly.

@d0ugmac1 I'll have to check it later when I get home. I can VPN out and try to come back in from another PC and see what happens. Thanks for the advise.

@d0ugmac1 Actually, I think I figured it out.