Cisco AnyConnect or IPSec user/ip authentication restriction

Question

I'm trying to restrict some users from authenticating and accessing the VPN from home.

I have a Cisco ASA5505, they use AnyConnect or IPSec, and I only want them to gain access to the VPN when they're at the office. I can't block everything and allow only office IP because we do have some users who roam around and need access to Cisco from different locations.

Is there a way to restrict certain users only to access the VPN or even authenticate from certain IPs?

Answer 1

The simplest solution would probably be to buy another Cisco ASA 5505 for the remote office you are connecting from, and do a Site to Site (or EasyVPN) connection for the whole office LAN. Will be a lot easier to support, and more effective use of your bandwidth.