Restrict vendor access via VPN

[curtist]

Hello, I have a need for a third party vendor to access the webui of a server within my network. I would like to limit their access to only this device so they can't attempt to access anything else on my network.

I am running Cisco ASDM 7.9, and connecting to Firepower 5525's running 9.14.4.

I have been able to create a second VPN profile for the vendor using an account authenticated against the firewall and tested access, they are able to hit the IP they need, but can also access everything else on my network.

I am looking for assistance setting up ACL traffic to limit to one IP address.

Thanks in advance.

[Rob Ingram]

@curtist you could apply a VPN Filter to this third party vendor, to restrict their access.

https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/99103-pix-asa-vpn-filter.html

[Marvin Rhoads]

As @Rob Ingram suggested, vpn-filter is one way. Another method is for your second profile to only tunnel-specified (vs. tunnel-all) and only include the server address in the ACL that's used.