Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Cisco ASA that authenticates off of RADIUS / AD. I need to give a user VPN access but I want to limit their access to only one host. What is the best way to do this?

share|improve this question
Which version of the ASA software are you using? ASA 8.4 includes user based access-control which might work for you. – dunxd Nov 17 '11 at 14:46
8.2 and I want to upgrade but wont be able to just for this. – evolvd Nov 17 '11 at 15:37
up vote 1 down vote accepted

Here is what I ended up doing:

Create a new group-policy that has the split-tunnel with only the host/network I want the VPN user to access. Then create a ACL to only allow network access to what you want. Apply this ACL to the GP with the following command: vpn-filter value (you have to apply this when you are in the GP attributes). Then make a new group-tunnel and tie it back to the new GP. Now you can give this user the new PCF and the user will be locked down to the host / network you specified.

I was hoping to find a solution where I wouldn't have had to make a new GP, TP, and local ASA user but this works I guess.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.