I have configured this on serval client installations. Create an access-list that defines the (private) source and destination networks that you want to authenticate and/or authorize for. Use the following command:
aaa authentication match ctap-list-name outside
After your ipsec packets are decapsulated, the source and destination are evaluated against any access-groups on the outside interface before being permitted access to the network. The purpose of the sysopt connection permit-ipsec command is to bypass this check. Otherwise you have to explicitly permit private traffic arriving on the outside interface. This always scares me, but if you carefully compare the crypto access-lists with the inbound access-groups you will see that the security risk is minimal. Fortunately, the sysopt connection permit-ipsec command only bypasses access restricted by access-groups. It does not bypass aaa inspection. Therefore, your aaa authentication match command can be successfully applied even when ipsec traffic is assumed trusted by the firewall.
An interesting twist on this is to use csacs radius server to distribute downloadable ip acls. This way you can configure a general VPN tunnel and use the aaa authorization to enforce a specific network security policy by user or group.
Another interesting trick is that you can use the same downloadable ip acl from the aaa server for your VPN clients. You can then have a single user configuration on the aaa that controls their access to network segments differently depending on their source address which is different between their native vlan and when accessing through the vpn client.
This should work with local aaa as well, but I have never tested this.
Brad
