@MR.S it is a site to site IPSEC VPN tunnel. The ER7206 is the host site, and another vendor's routers are on the remote ends of the tunnel. So, two different site to site tunnels with the ER7206...

@MR.S I'm not sure this would work for me. Block just the rfc1918 addresses would not prevent all of the public IP's that currently have access. How are you setting up the Remote_LAN IP Group?

trying to set up ipsec tunnel and configure the firewall on an ER7206. Manual configuration. The IPSEC tunnels are working properly; however, when I put a deny rule in access control the router does...