2

Currently we have an ASA with an IP pool to allow an outside contractor to remotely connect and access our network. What we would like to do is limit what they can get to once they are connected. I have limited knowledge on this subject but am trying to piece together as much as possible before making the change as I obviously want to research as much as possible before pulling the trigger. I'm new to this position and prefer not to take it down quite yet. :)

There is a local pool on the ASA called "vpnpool-Contractor" with an IP range of 10.50.50.20-254. I would like to allow them access to only three servers:

10.50.35.40

10.50.35.41

10.50.35.42

Seems to me I should be able to use an ACL to disallow them access to anything but those listed, but wasn't 100% sure on my syntax. This is what I have so far:

Config t
access-list vpnpool-Contractor-ACL permit 10.50.50.0 10.50.35.40  
access-list vpnpool-Contractor-ACL permit 10.50.50.0 10.50.35.41 
access-list vpnpool-Contractor-ACL permit 10.50.50.0 10.50.35.42
access-list vpnpool-Contractor-ACL deny any any

But I was thinking I would still need to tie it to an interface/group to make it work...or am I remembering that wrong?

Any help would be appreciated, thanks!

1

0

You must log in to answer this question.

Browse other questions tagged .