Restriction for remote vpn users in ASA

[kunalchopra1992]

Hi Team,

We have remote access VPN users terminating to ASA and thereby accessing our internal users.

Now I want to ask whether it is possible that My user A can only access server B but not C. 

Can i configure any such restriction to my VPN users ? I know about applying VPN filters to group policy but that again I need to use whole ACL whereas I want user specific policy ?

Can anybody help ? 

ASA version:- 9.4

[Marvin Rhoads · Accepted solution]

Where is your authentication done - locally on the ASA or via a AAA server? If AAA, what kind (ACS, ISE, AD etc.) How many rule sets do you need?

Depending on the answers, there are a couple of options. For example:

https://supportforums.cisco.com/discussion/11162686/access-list-remote-access-vpn-users

https://supportforums.cisco.com/discussion/11992626/how-restrict-vpn-users-access-specific-server

[kunalchopra1992]

Hi Marvin,

Thanks a lot. Those posts  answered all my queries.

Just one more thing I want to ask ;- If we are using 'username attribute' while doing local authentication to ASA.

Can we use this 'username attribute' while doing my authentication to my RADIUS server ?

or this 'username attribute' functionality is only used with LOCAL authentication on ASA not with AAA ?

Regards,

thanks

[Marvin Rhoads]

You're welcome.

The local username on the ASA and any attributes defined are strictly local.

If you are using an external AAA server then it must retrieve attributes from its own identity store (or an upstream one - like when ACS retrieves AD group membership for a user and passes the appropriate authorization back to the ASA as as a RADIUS A-V (attribute-value) pair).

[kunalchopra1992]

Thanks Sir!

It also means that once I configure my AAA server as authentication method instead of LOCAL ASA, then  configuration of all usernames specific attributes will be of no use , right ?

[Marvin Rhoads]

You're welcome.

Not necessarily. The authentication and authorization servers are configured per tunnel-group. So you could have local users for some tunnel-groups and external users for others.