AnyconnectVPN - how to allow a specific public-ip?

[Imran Ahmad]

Hello,

how can i configure my ASA to allow a specific public-ip address to connected through Anyconnect VPN session , and block all other ip addresses.

I searched Group-Policy but could not find the option

Thanks

[rvarelac]

Hi Imran, 

This can be done with an ACL applied to the control-plane of the ASA, example:

access-list VPN permit tcp host 1.1.1.1 any eq 443
access-list VPN  permit udp host 1.1.1.1 any eq 443
access-list VPN deny tcp any any eq 443
access-group  VPN  in interface outside control-plane

This should allow the IP "1.1.1.1" to connect over Anyconnect on reject any other IP. 

Hope it helps

-Randy-

[Imran Ahmad]

Hi Randy,

the above commands u writen blocks https completly for all other ips except 1.1.1.1.  that is what i do not want. rather I want to allow a single ip to a specific connection-profile, and block all other ip adds to connect through that connection-profile.    BUT I DONT WANT to block https at whole my ASA.

how to do that ? 

[Imran Ahmad]

anyone else can help me please