Good afternoon,

We need to provide a vendor access to a server located on the inside of the network (MS SQL Server). I have a couple questions along these lines:

1. We currently allow vpn access to IT staff on our ASA 5510 (which is privately managed). We currently have one authentication group for our IT staff. Is there a way to have two authentication groups? We're using a MS radius server to authenticate before access is approved.

2. Once the vendor is connected, what would be the best way to restrict them to only the one box?

Our concern is that they would be able to launch telnet, file share, etc...I realize this may be best handled by MS group, but was thinking about access lists..

Any thoughts would be appreciated.