Hi,
We have an SSL VPN setup on our ASA (8.4) that users can connect using Webvpn and Anyconnect and ipsec, the authentication is ldap and OTP, and they can pretty much access anything they need on the network.
We now have a requirement to publish a web app (HTML) to mobile devices which to abide to our security policy needs to be 2 factor also, the app itself cannot facilitate this and we have also tried some other methods that are not that great so I have been asked to demo what we can do using anyconnect for mobile.
I initially thought this would be straight forward - get a trial license and let them connect to the same tunnel-group & group policy they connect to already and then give them the URL to connect to the web app. BUT then my boss said that the current tunnel-group and group policy allows access to everything and he doesn't want that, he wants the mobile access to be restricted to just this one web page.
I don't mind creating a new tunnel-group and group policy for the mobile devices but as the users of the mobile devices are the same users of the existing VPN how do I restrict it so when they connect from a mobile they are only allowed to this web page, can I do a restriction based on the fact they are coming from a mobile (I don't think you can) or what seems more feasible is can I force the mobile devices to only use the new tunnel-group & group policy, my concern here is if they were able to change the group in anyconnect on their mobile then they will be allowed to authenticate on the group they use for their other connection and thus access everything again.
Hope this makes sense, thanks in advance.
