I'm using a Cisco ASA as a VPN endpoint. Where do the VPN clients get firewalled?

Question

(Is this too application specific? It seems like a reasonable question that would be useful to other people...)

So, I've got this ASA in front of a network that I didn't set up. It's been configured with the clicky GUI (the ASDM), not the CLI, but I'm willing to use the CLI if it makes more sense. One of the jobs of this ASA is to allow remote users to VPN in and use internal stuff. It does this well enough. However, now I'm wanting to limit where those VPN users go. Where do I insert firewall rules for them? There are two networks on the thing, creatively labeled "outside" and "inside".

If I were making a firewall rule to say "X external entity can get at this internal thing", I would put it on the "outside" interface. Same for VPN clients?

Answer 1

Here's how to do it: tunnel_vpn_userX controls what subnets to tunnel, filter_vpn_userX applies normal access list filtering within that tunnel.

object-group network tunnel_vpn_userX_local
 network-object <some local network>
 ...

access-list tunnel_vpn_userX extended permit ip object-group tunnel_vpn_userX_local any
access-list filter_vpn_userX extended permit tcp any <some local address> eq www

username userX password ...
username userX attributes
 vpn-group-policy userX
 vpn-tunnel-protocol IPSec
 service-type remote-access

group-policy userX internal
group-policy userX attributes
 vpn-filter value filter_vpn_userX
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value tunnel_vpn_userX

Hope I didn't miss anything...