Solved: Restricting Remote Access VPN

shijomon scaria · ‎08-21-2009

Hello,

How can i limit Remote Access VPN users, only to a pariticular ip address in may inside network, say 10.10.10.1

Thank you.

jason.espino · ‎08-28-2009

If you have an ASA you can simply create a new ACL defining the single inside host to communicate to the network/pool used for the Client VPN users.

You can apply the vpn-filter to the group-policy however doing so all users using that group-policy will inherit that vpn-filter and be restricted to the traffic you have defined within the filter ACL.

If you wish to restrict access for a specific user you can apply that same vpn-filter for that specific user within the user attributes. This filter would not affect connectivity for all of the users connecting to the same group-policy only the user bound to the filter.

View solution in original post

andrew.prince · ‎08-21-2009

You have multiple options:-

1) Write an ACL that is applied to the VPN client.

2) Allow them all access - and write an acl to be applied to the outbound direction of your inside interface

3) Write an ACL for that 1 device and configure is for split tunneling.

4) Assign a dynamic ACL upon connection (this requires an ACS)

HTH>

kwillacey · ‎08-21-2009

You can also try using a vpn-filter which you apply to the group policy. hth

shijomon scaria · ‎08-23-2009

Could you please give some examples to do the same...

Thank You.

andrew.prince · ‎08-24-2009

http://www.cisco.com/en/US/products/ps6120/prod_configuration_examples_list.html

jason.espino · ‎08-28-2009

If you have an ASA you can simply create a new ACL defining the single inside host to communicate to the network/pool used for the Client VPN users.

You can apply the vpn-filter to the group-policy however doing so all users using that group-policy will inherit that vpn-filter and be restricted to the traffic you have defined within the filter ACL.

If you wish to restrict access for a specific user you can apply that same vpn-filter for that specific user within the user attributes. This filter would not affect connectivity for all of the users connecting to the same group-policy only the user bound to the filter.

shijomon scaria · ‎08-29-2009

Thank you very much jason, i will go for the first option, that will do magic for me..........

Thakns for all who responded on ma query...

Regards,

Shijo.

ray_stone · ‎08-31-2009

Hi,

I have configured Remote VPN on outside interface for outside users. Now I want to allow only few IP's to access the Remote VPN so for this, what configuration is required. Pls expain an example if possible.