I have a group of individuals who I would like to give VPN access into our network (via PIX 515). The only thing I would like them to be able to do is access an AS400 which is actually outside our network (connected via dedicated T1). I don't want them to be able to access any other internal network resources. I currently have a VPN group set up (for IT) which has access to all network resources as well as the AS400. Can this be done?