Anyconnect options

[Roger Base]

Hi.

I have question regarding anyconnect solution. Is it possible to make diffrent access levels. I mean if I use local users or active directory. For example username:syadmin should full access on all VLANS. username:consultant should only have access to interface VLAN10(192.168.10.1) on the ASA.

If yes. How should this be solved?

Thanks!

[Marius Gunnerud]

I am not sure I fully understand what you want to do.  Do you mean you want to restric administration of the ASA or you want to restrict LAN access?

--

Please rate all helpful posts

[Roger Base]

I mean user X will only have access to VLAN XY and user Z will have access to XYZ

[m.kafka]

You should take a look into IPv4 Filters for the connection. Assign different policies to the users and configure IP filters, allowing acccess only to permitted destination IP ranges/subnets.

Rgds,

MiKa

[Roger Base]

Is that DAP? How do you differentiate users in anyconnect settings? I wanna tell ASA to apply accesslist X for user Y and apply accesslist for V for user Q when connected throug Anyconnect.

[Marius Gunnerud]

What  you want is VPN filter.  You just add a ACL under the group policy that the user belongs to.  If you want different Access for different users you will need to configure seperate group policies for the different access levels.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00808c9a87.shtml

--

Please remember to rate and accept a correct answer