Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

(Is this too application specific? It seems like a reasonable question that would be useful to other people...)

So, I've got this ASA in front of a network that I didn't set up. It's been configured with the clicky GUI (the ASDM), not the CLI, but I'm willing to use the CLI if it makes more sense. One of the jobs of this ASA is to allow remote users to VPN in and use internal stuff. It does this well enough. However, now I'm wanting to limit where those VPN users go. Where do I insert firewall rules for them? There are two networks on the thing, creatively labeled "outside" and "inside".

If I were making a firewall rule to say "X external entity can get at this internal thing", I would put it on the "outside" interface. Same for VPN clients?

share|improve this question
up vote 5 down vote accepted

Here's how to do it: tunnel_vpn_userX controls what subnets to tunnel, filter_vpn_userX applies normal access list filtering within that tunnel.

object-group network tunnel_vpn_userX_local
 network-object <some local network>

access-list tunnel_vpn_userX extended permit ip object-group tunnel_vpn_userX_local any
access-list filter_vpn_userX extended permit tcp any <some local address> eq www

username userX password ...
username userX attributes
 vpn-group-policy userX
 vpn-tunnel-protocol IPSec
 service-type remote-access

group-policy userX internal
group-policy userX attributes
 vpn-filter value filter_vpn_userX
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value tunnel_vpn_userX

Hope I didn't miss anything...

share|improve this answer
Ok. Any idea where that is in the clicky interface, if anywhere? – Bill Weiss Jan 10 '11 at 23:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.