SSL VPN Authorization

Unanswered Question
Jun 25th, 2009

Hi, The SSL VPN users are authenticated with ADS for connecting the SSL VPN. How to restrict the users with the access servers listed in Split tunnel. For example in Split tunnel there are 4 servers from Server-1 to Server-4

When user-1 logs in he should be able to access Server-1. He should not be able to access the other three.. The rest of users should be able to access all the servers. Pls advise.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
branfarm1 Fri, 06/26/2009 - 10:49

The easiest way would be to use ACS to have downloadable ACL's for each user.

Not using ACS though, you might have a tougher time. Hopefully somebody has a good way to do this. Off of the top of my head, you might be able to try creating two different Connection Profiles -- one for access to the 1 server, one for access to the other 3 servers, then associate a different Group Policy to each connection profile. This would allow you to define two ACL's that would block what you wanted.

So you would have two Connection Profiles:



You would also create two group policies:



Also need two ACL's:

access-list AllowServer1 permit ip any

access-list AllowServer1 deny ip any any

access-list AllowServer2-4 permit ip any

access-list AllowServer2-4 permit ip any

access-list Allowserver2-4 permit ip any

access-list AllowServer2-4 deny ip any any

Then you have to use the respective ACL's as filter lists on the matching group policies and connection profiles.

Like I said... off the top of my head. Hopefully someone knows an easier way.

lbelodeau Mon, 07/06/2009 - 05:12

Thanks Bran, I will check for the same. Do you have any idea about Dynamic Access Policy? Will that help in this ?


This Discussion