Hi,
Well I think there would be a few different basic options to approach this
If you are using local authentication on the ASA for the VPN user then you can actually use the same VPN you have configured for yourself but attach a VPN Filter ACL to the "username" configuration/attributes of the user that needs limited connectivity.
As a similiar option compared to the above you could actually leave out the VPN Filter ACL and change the ASA global setting that defines how connections incoming from VPN are handled. There is a setting called "sysopt connection permit-vpn" that is the default setting (doesnt show in the CLI configuration). This essentially means that any connection coming through a VPN Connection will bypass the VPN interface ACL. If you were to change this setting to "no sysopt connection permit-vpn" then ANY connection coming through VPN would require ACL rule in the VPN interfaces ACL. If you were to use local authentication or otherwise knew the IP address the user would get on VPN login you could then use the actual interface ACL to allow only the traffic it needs and for example allow all traffic for your own full access VPN.
You could ofcourse also configure a completely new VPN profile for these users and configure the VPN Filter for that whole group. This might in some sense be clearer setup when you have a VPN profile that is specifically used for your own purposes that allow full access while the other group is specifically meant for some external users perhaps.
Hopefully the above made any sense
- Jouni
