VPN Client access restriction

[imranraheel]

I want to restrict VPN clients to few systems. Currently who ever accesses the office LAn via VPN is able to access every system.

Is there any way to restrict

[husycisco]

Hi Imran

Sure.

group-policy yourexstingvpnpolicynamehere attributes

vpn-filter value restrictions

Now If you want to allow specific traffic and deny the rest, use following

access-list restrictions extended permit ip yourvpnclientpool yourvpnclientpoolmask host insideclientipz

access-list restrictions extended permit tcp yourvpnclientpool yourvpnclientpoolmask host insideclientipy eq 1433

access-list restrictions extended permit ip yourvpnclientpool yourvpnclientpoolmask host insideclientipx

access-list restrictions extended deny ip any any

If you want to deny specific traffic and permit the rest, use the following

access-list restrictions extended deny ip yourvpnclientpool yourvpnclientpoolmask host insideclientipz

access-list restrictions extended deny tcp yourvpnclientpool yourvpnclientpoolmask host insideclientipy eq 1433

access-list restrictions extended deny ip yourvpnclientpool yourvpnclientpoolmask host insideclientipx

access-list restrictions extended permit ip any any

Regards

[acomiskey]

Here's one way...

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a0080641a52.shtml

[husycisco]

Ah, I was typing the above edited post and you sent the link :)