Restrict access to VPN Tunnel Group based on Source IP

[craigstrait]

I have a semi-trusted remote network, say 10.10.10.10. When users are on that network I want them to have the ability to connect using a specific Tunnel Group profile, say 'GroupONE.'

When these users travel to a different network, I don't want them to be able to VPN back using the 'GroupONE' profile.

Thoughts on how I'd restrict that?

ASA-5540

Thanks so much!

Craig

[b.julin]

"tunnel-group-map XX enable peer-ip/ike-id"?

[craigstrait]

I'm not terribly familiar with the rules surrounding certificate matching. I've spent the last two days trying to read everything I can find on that subject and have found the documentation to be quite limited. Can you give me a better idea of how that may work? Is the client's source IP address contained in the certificate?

[b.julin]

I haven't used these options but my best guess would be that "ike-id" would be something that the client pulls from the certificate and then sends during Phase 1 negotiation where the ASA can pick it out and use it, whereas "peer-ip" would be taken by the ASA from the source address of the incoming ISAKMP packets.

However many clients may be configurable to send their IP as the phase 1 ike-id instead of certificate contents.