CSA with VPN Client and remote access

[costin.vilcu]

Hi everyone!

I have the folowing isue: i have to tune CSA for a clinet that conects remotely with VPN Client only. He should not be able to connect to any other network neither lan nor dial-up.

Any idea of what policy should i modify or tune?

thanks

[tsteger1]

Probably a Network Access Control rule that allows addresses from the VPN to only access those resources which you desire. All ours come from a single address and we can restrict as necessary.

Tom S

[costin.vilcu]

thanks tsteger11

but i don't think this will solve it: beside the client connecting with VPN client to the main network, he shouldn't be able to connect to any network (lan or dial-up) when the VPN client is off. I mean the only connection that he can make should be through VPN Client.

thanks again,

costin

[ciscors · Accepted solution]

You can create a network access rule which is dependent on a system state. The system state condition can be defined to have an address set which belongs to the VPN range and the network access rule would state that the client machine can only act as client/server on UDP/TCP ports when the system state is satisfied.

Hence, if the laptop isn't connected to the VPN, it wouldn't be able to act as a client/server for any connections at all and will be locked out. You would have to create an exception for the IP address of the VPN server at your corporate offices and allow those ports to be open from the CSA client.

[costin.vilcu]

thanks ciscors, that was the ideea.

also thank you tsteger

[ciscors]

great

please rate this post

thx

[tsteger1]

You're welcome. Sorry I didn't see your second question, I was on vacation!

Tom S