Well you can remove the systop connection permit-vpn command and allow VPNs through ACL only. This command bypasses ACL check for firewall-terminated crypto traffic; its enabled by default. Disable this, and allow each SPECIFIC IP access to specific crypto interface. Or Deny some and allow others (this would specially be true on the outside).
ASA 8.1 added support for netflow but only on the higher end models (5580-XX). Maybe we see it in the future on other models as well.
For the PIX you don't need to even control this! The host can only 'hit' the crypto map to which it is 'coming from'.
e.g Source IP for VPN client is 4.4.4.4. If this s reachable via the Outside interface (via default route), this host can ONLY access the 'outside' crypto map' It wont be able to access any crypto map applied on other interfaces like DMZ1 , WAN etc.
Say we have a firewall with two interfaces:outside and inside. I've credential (VPN Group and username and password)...we have isakmp enabled on outside and inside...i want that the user using the credential can access in VPN only on one interface (say inside); i don't want control the IP address..
Thank you.
Massimiliano.
P.S.: Another question...PIX or ASA support NetFlow?
Well you can remove the systop connection permit-vpn command and allow VPNs through ACL only. This command bypasses ACL check for firewall-terminated crypto traffic; its enabled by default. Disable this, and allow each SPECIFIC IP access to specific crypto interface. Or Deny some and allow others (this would specially be true on the outside).
ASA 8.1 added support for netflow but only on the higher end models (5580-XX). Maybe we see it in the future on other models as well.
But I want lock a group to a particular interface...
Massimiliano.
Getting Started
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:
