Solved

Need help with VPN group user access to distinct internal networks

Posted on 2007-11-14
3
191 Views
Last Modified: 2013-11-16
I have a working 5500 that I need to modify.  I need to be able to permit specific VPN groups to access certain internal networks.  For example I want one group to be able to access 10.41.20.0/23 and another access to 10.96.11.0/24.  I still would need one admin group that access to all internal network.  Any help would be greatly appreciated.  I have read all the docs I can get my hands on and nothing seems to work.
0
Comment
Question by:samlowe2
  • 2
3 Comments
 
LVL 28

Expert Comment

by:batry_boy
ID: 20286014
access-list LimitedAccess1 extended permit ip any 10.41.20.0 255.255.254.0
group-policy LA1 attributes
 vpn-filter value LimitedAccess
tunnel-group group1 general-attributes
 default-group-policy LA1

access-list LimitedAccess2 extended permit ip any 10.96.11.0 255.255.255.0
group-policy LA2 attributes
 vpn-filter value LimitedAccess
tunnel-group group2 general-attributes
 default-group-policy LA2

You should be able to take the above code and merge it into your existing group policy and tunnel group names, but that should do it.

For your admin group, just create another tunnel group and don't apply any filtering to it.  It defaults to not having an ACL applied to a tunnel group when you create one.
0
 
LVL 28

Accepted Solution

by:
batry_boy earned 250 total points
ID: 20286024
Whoops, change the following lines in the above post:

First set of commands:

change "vpn-filter value LimitedAccess" to "vpn-filter value LimitedAccess1"

Second set of commands:

change "vpn-filter value LimitedAccess" to "vpn-filter value LimitedAccess2"

sorry about that...
0
 

Author Comment

by:samlowe2
ID: 20286170
Thanks so much.  I also found the Cisco docs on the subject once you provided the correct syntax.  It was an easy find after that.  You saved me a lot of time and trouble.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Join & Write a Comment

Some of you may have heard that SonicWALL has finally released an app for iOS devices giving us long awaited connectivity for our iPhone's, iPod's, and iPad's. This guide is just a quick rundown on how to get up and running quickly using the app. …
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now