topic Re: access-list for remote access vpn users in Network Security

access-list for remote access vpn users

Ibrahim Jamil — Mon, 11 Mar 2019 20:17:40 GMT

Hi Folks

How to designate access-list for the remote access vpn users in order to let them access specific subnet or host,

asa 5510 and acs is in the picture

Re: access-list for remote access vpn users

Jennifer Halim — Wed, 06 Apr 2011 22:27:20 GMT

You can configure "vpn-filter" access-list to allow them to only access specific subnets.

The ACL will say: from

You can also add TCP or UDP port to the access list.

The ACL is then applied to "vpn-filter" then to the specific group-policy.

Here is the command for your reference:

http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/uz.html#wp1630190

Hope that helps.

Re: access-list for remote access vpn users

Ibrahim Jamil — Thu, 07 Apr 2011 05:50:51 GMT

Hi Halim

thanks for your reply

but my freind every time the vpn user get other ip for the same pool, however i need full access to other user connected

Re: access-list for remote access vpn users

Jennifer Halim — Thu, 07 Apr 2011 06:38:02 GMT

If you are using ASA local database as the authentication server, you can configure specific IP Address for that user.

Then you can create multiple vpn-filter accordingly, and assign the vpn-filter to the group-policy, and lastly, assign that group-policy to the user.

You can just create specific IP Address, vpn-filter, group-policy for the user that you want more restricted access, and leave the rest as what is currently configured.

Just make sure that the ip address that you assign to the user does not overlap with the ip pool that you have created.

Hope this helps.

Re: access-list for remote access vpn users

Ibrahim Jamil — Thu, 07 Apr 2011 06:47:09 GMT

Hi Halim

i m using ACS for authentication , now how?

thanks for sharing the knowledge

Re: access-list for remote access vpn users

Bastien Migette — Thu, 07 Apr 2011 06:56:54 GMT

Hi Ibrahim.

In ACS, set the radius attribute 25 (class) to: 'OU=GROUP_POLICY_NAME;'

Then define a group policy called GROUP_POLICY_NAME on your asa with the correct vpn filter.

Alternately, you may have a vpn-filter attribute that you can configure in ACS. Check the interface configuration, and radius VPN3000/ASA.

Hope this help.

Re: access-list for remote access vpn users

Ibrahim Jamil — Thu, 07 Apr 2011 08:59:52 GMT

hi,can u please paste a sample for the configuration based on the below input

also my pool its like 172.16.30.100 - 172.16.30.200

the destination address witch i want to be restricted for specific users its 172.16.50.0/24

i forgot to mention that we are using client full vpn

thanks in advance

Re: access-list for remote access vpn users

Bastien Migette — Thu, 07 Apr 2011 09:12:51 GMT

Go in Interface Configuration, Advanced Settings on ACS, and check "Per-user TACACS+/RADIUS Attributes"

then in Interface Configuration, Radius IETF, check "[025] Class" for User (assuming you want per user policies. If you want to make a policy for a group of users, just edit the group of the user instead of the user in ACS)

Edit your user, and modify the attribute 25: (OU=MyGp;)

and then create the group policy on the asa:

access-list MyGpFilter extended permit ip any host 1.2.3.4

group-policy MyGp internal
group-policy MyGp attributes
vpn-filter value MyGpFilter

This will indicate the ASA that the user should use the group policy MyGp, and the group policy define a VPN Filter.

Re: access-list for remote access vpn users

Ibrahim Jamil — Thu, 07 Apr 2011 09:37:32 GMT

thanks bastien

Re: access-list for remote access vpn users

Ibrahim Jamil — Sat, 09 Apr 2011 12:08:17 GMT

hi again

my users will be resided in active directory,so now what the config will be? my manger wont accept users in the acs , now how to do it?