Create an anyconnect VPN to a specific Vlan on Cisco ASA 5506

[LogicalIT]

Hello,

Excuse my ignorance but how would (if possible) setup an ASA 5506 anyconnect vpn to only go to a manually created Vlan? We have a department that should only have access to the devices that are on a Vlan 20 and not reach any other networks. Is it also possible to do it through ASDM?

[Francesco Molino · Accepted solution]

Hi

During the vpn creation, you can decide to tunnel all traffic or specific traffic. You can choose to tunnel specifc traffic. This will ask you to create an acl on which you can only put your vlan 20.

If the vpn is already used and filter some specific users only to this vlan, you can assign an acl called vpn-filter to these users.
If you need help with configuration let me know in which situation you're in.

[LogicalIT]

Thank you for the assistance. In this case the VPN is already setup. What would be my next steps? I am not sure where to find the place to assign an acl for it

[Francesco Molino]

Ok. Can you share your config please?
Are users authenticating against a radius server or using the local database.
If you share it, I'll be able to provide the config part for your need.
Here a doc explaining vpn filter:
https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/99103-pix-asa-vpn-filter.html

[LogicalIT]

thanks after redoing the VPN and seeing the options I was able to add the acl ect. Appreciate the help!