control what anyconnect remote user can access

[nflnetwork]

How do i control what networks / Hots  my any-connect VPN user group can access?

Ex:

I have a group called EXTERNAL

I want EXTERNAL only to have access to 192.168.1.5 and 192.168.1.10 hosts and nothing else.

Where do i place my statements ?

[Rob Ingram · Accepted solution]

Hi,

You could create VPNFilter, reference here and you'd then apply this to the group-policy. You'll need to amend the source network to be your VPN Pool. Example:-

access-list VPN-FILTER permit ip x.x.x.x 255.255.255.0 192.168.1.5 255.255.255.255
access-list VPN-FILTER permit ip x.x.x.x 255.255.255.0 192.168.1.10 255.255.255.255

group-policy EXTERNAL attributes
 vpn-filter value VPN-FILTER

Alernatively if you are using ISE as the RADIUS server you can push down a DACL.

HTH

[nflnetwork]

what if i wanted to take it 1 step further permit custom port tcp 446 only ?

[Rob Ingram]

So you can tweak the ACL to permit tcp and specify the ports instead of permit ip. E.g:-

access-list VPN-FILTER permit tcp 10.10.10.1 255.255.255.255 192.168.1.0 255.255.255.0 eq 446

That reference link I provided goes into more detail for you.


HTH

[nflnetwork]

did not receive the link. 

also when creating a ACL is all other traffic implicitly denied?

[Rob Ingram]

Ah ok, the link was a hyperlink under the word "here" in the original post, it should have been highlighted. I've made it a bit more obvious this time:-

https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/99103-pix-asa-vpn-filter.html

Yes, implicit deny.