blocking connections between servers

[jessica jestol]

I'm using an ACL to limit access for one of my anyconnect users. The ACL does it's job and restricts the user from being able to connect to anything but the permitted IPs. However, once the user connects to a permitted server, they can then ssh to other servers on that vlan from the permitted server. Is there any way to prevent this from the firewall?

[balaji.bandi · Accepted solution]

Since your source of the IP changed (going via server) you need to have ACL to block that.

example :

any connect IP x.x.x.x

x.x.x.x rdp to y.y.y.y 

since y.y.y.y has access to z.z.z.z ( you need to see if this can be controlled)