how configure MSR1003 for ssh access?

[alex20]

please, help..

i am create this config,  it's for site-to-site. but i can't connect by ssh to ip xx.xx.xx.xx  if my Host behind a router yy.yy.yy.yy

what need more?

 ip pool magazin 10.10.10.2 10.10.11.250 
 ip pool magazin gateway 10.10.10.1 

interface Virtual-Template0
 ppp authentication-mode ms-chap-v2 domain system 
 remote address pool magazin 
 ip address 10.10.10.1 255.255.254.0
 ospf cost 10
#

interface GigabitEthernet0/0
 port link-mode route
 speed 100 
 ip address xx.xx.xx.xx 255.255.255.224
 packet-filter name WanInterfaceIn inbound
 nat outbound name internetACL
 ipsec apply policy map1

acl advanced name PermitIPsec
 rule 5 permit ip source xx.xx.xx.xx 0 destination yy.yy.yy.yy 0
 rule 10 deny ip

ipsec transform-set tran1
 encapsulation-mode transport
 esp encryption-algorithm 3des-cbc 
 esp authentication-algorithm sha1 
ipsec policy map1 10 isakmp
 transform-set tran1 
 security acl name PermitISAKMP 
 remote-address yy.yy.yy.yy   
 ike-profile profile1

l2tp-group 1 mode lns
 allow l2tp virtual-template 0
 undo tunnel authentication

 l2tp enable

ike profile profile1
 keychain keychain1
 match remote identity address 0.0.0.0 0.0.0.0
 proposal 3 

ike proposal 3
 encryption-algorithm 3des-cbc
 dh group2

ike keychain keychain1
 pre-shared-key address 0.0.0.0 0.0.0.0 key cipher $c$3GdKRkNTo0mSO/41uuJ7CKQ=

[shinepothen]

what ever access-list you have defined those access-list source and destination only you will be able to access.

because encry/decry will happen to source/destination of the Access-list.