IPSEC RA - activate crossed but restrict access to the web

ASA5520 8.2 (5) 30

Greetings,

I have an IPSEC RA strategy that has implemented to tunnel all traffic (no split tunnel) by the ASA (which ends on the external interface).  I need to be able to allow VPN users to access a web page (crossed) thesesame on the external interface.

++++++++++++++++++++++++++++++

Here are the current settings:

Group Policy Admins L internal

attributes of Group Policy L_Admins

value of server WINS 172.16.0.33 172.16.0.9

value of 172.16.0.33 DNS server 172.16.0.9

VPN-idle-timeout 60

VPN-session-timeout 480

VPN-value filter-admin-l

IP 172.30.4.0 allow Access-list l-admin-test-filter extended 255.255.255.252 host 172.16.0.33

IP 172.30.4.0 allow Access-list l-admin-test-filter extended 255.255.255.252 host 172.16.0.9

IP 172.30.4.0 allow Access-list l-admin-test-filter extended 255.255.252.252 172.16.1.4 host

IP 172.30.4.0 allow Access-list l-admin-test-filter extended 255.255.252.252 welcome 172.16.1.2

access-list extended l-admin-test-filter permit ip 172.30.4.0 255.255.252.252 10.24.0.0 255.252.0.0

IP 172.30.4.0 allow Access-list l-admin-test-filter extended 255.255.252.252 the host 172.16.0.233

Protocol-tunnel-VPN IPSec

Split-tunnel-policy tunnelall

value by default-field IHI.local

type tunnel-group L_Admins remote access

attributes global-tunnel-group L_Admins

address ili_global pool

PhoneFactor authentication-server-group

Group Policy - by default-L_Admins

IPSec-attributes tunnel-group L_Admins

pre-shared-key *.

++++++++++++++++++++++

Crossed is not currently enabled, so I guess I have to add:

permit same-security-traffic inter-interface

and (I guess)

mask IP local pool l_admins 172.30.4.1 - 172.30.4.2 255.255.255.252

Global (outside) 1 interface * PAT IP

NAT (outside) 1 mask 172.30.4.1 - 172.30.4.2 255.255.255.252

But from there I don't know how to restrict access to a single external IP on the web on port 80.

Hello

Enter the correct command to permit traffic and the same interface of leave is

permit same-security-traffic intra-interface

The command you posted allow traffic between 2 different interfaces that have the same value of 'security level'

permit same-security-traffic inter-interface

What about PAT Dynamics for Internet traffic

If you have already

Global 1 interface (outside)

Then you will need the command "nat" for the VPN pool

NAT (outside) 1 172.30.4.0 255.255.255.252

In what concerns the control of Internet traffic, should not be able to simply add this destination IP address to the VPN filter ACL you have ever used? I mean the ACL named "l-admin-test-filter".

For example

L-admin-test-filter access list note allow the external server connection

access-list l-admin-filter-test permit tcp 172.30.4.0 255.255.255.252 host eq 80

access-list l-admin-filter-test permit tcp 172.30.4.0 255.255.255.252 host eq 443

access-list l-admin-filter-test permit tcp 172.30.4.0 255.255.255.252 host eq 8080

-Jouni

Tags: Cisco Security

Similar Questions

  • How to restrict access to the drive of Wndows xp sp3?

    I have 3 user account on my computer, it is has the administrator rights and the other is a standard user account.

    I want to restrict access to all readers for the standard player.
    I used gpedit.msc to enable the administrative model, but it also limits the account admin and me to access the road
    OS: windows XP SP3
    Please advice
    Hi Utkarsh.Ranjan,
     
    If you want to restrict access to a drive by using the Group Policy Editor, you can not apply for a particular user account. This will change for the user accounts.
     
    You can't restrict access to the complete transmission. However, you can resrtict access to folders and files inside a car to a particular user.
     
    Refer to the section "set, view, change, or remove special permissions for files and folders" in the following article and follow the steps to remove the authorization of the user access to the file/folder.
  • How to restrict access to the service web application deployed on weblogic for user group only

    I built the web service application in jdevelopler 11.1.1.7. Their security policy applied in the web service of the default Oracle policy which is (policy: Wssp1.2 - 2007-Https-UsernameToken - Plain.xml)

    Now all want to access the web service application must provide the name of user and password in the header section of the SOAP request to meet the requirement of the policy.

    the following steps I'm trying to restrict access to the application of web service with a specific group of users among users of weblogic:

    Connect to the weblogic administration console

    Create user or group of users

    Click on the links of deployments

    Select your web service

    Click the Security tab

    Click the sub-tab political

    Choose your authorization provider in the menu drop-down (looks like by default)

    Choose Add Conditions-> Group-> Type in the name of the Group

    Finishing

    But access is always available for all weblogic users (IE users not in the group specified in the above security configuration). How can I restrict access to only authorized group? Any thing lacking in my approach?

    There is nothing wrong with the steps mentioned in the question. In addition, you must do the following

    At the time of the application deployment with regard to the security part, there is a list in the title of the question (which security template you want to use with this application?)

    You must select (Advanced: use a custom template that you have configured on the page of configuration of the Kingdom) a configuration mentioned in the question will be work

  • Restrict access from the view of external endpoint

    Hello world

    I got an interesting question to come today: is it possible to restrict access to the view of physical endpoint?  This client does not support BYOD somehow and provided instead of thin laptops HP for their users access to the view since then at home, via a security gateway.  I know that you can disable the web interface from view completely, but they seek to block connections to nothing but these thin laptops.  Thank you!

    Here's a more recent document - https://www.vmware.com/files/pdf/VMware-View-KioskMode-WP-EN.pdf

  • Restrict access to the Page of the user in the relational database

    I have a relational database with two tables on a common ID field. The user can access all their entries in the child table with simple SQL queries and then select from a list of correspondence which of its documents records in the child table that they wish to change (i.e. ['ID'] ParentTable, ChildTable ['ID'])). Registration is then displayed using $_GET passed through the URL as parameter "recordID". However, when the user is connected and accessing a folder that matches the query, they can then enter another "RecordID" number in the URL and go to any record in the table child whether they are 'owner' of the record or not.

    I tried to put a statement of equivalence in the authorization user code to restrict the access to the child records users since ParentTable ['ID'] == ['ID'] ChildTable only when you are connected the user accesses the records they created previously. (In other words, when a user type a different "RecordID" in the URL, the ParentTable ['ID'] and ChildTable ['ID] are not equivalent.) The code that I entered in the authentication of the user generated by DW is as follows:

    If ((isset ($HTTP_SESSION_VARS ["MM_Username"]) & & ($row_ParentTable ['ID'] == ['ID'] $row_ChildTable))) {}
    ...

    Is still not accessible, even if tests show the ParentTable ['ID'] and ChildTable ['ID'] are not equivalent

    Any ideas on how to restrict access to the child records "unknown"? I'm sure it's relatively simple, but I'm having trouble to get through this obstacle.

    Thank you

    Thank you, Philo. In fact I got it to work by initializing a session variable of tha parent ID of the table and comparing it to the variable ID of child table, then using a header redirect in case of inequality. Part of my problem was where I put the code in the page. Anyway, it works now. It seems that the answer is always just after you have posted the question.

  • Cannot open email in Hotmail via Firefox. I have Vista installed on the pc and Windows 7 on the laptop, but cannot access all the features of Hotmail.

    Cannot open email in Hotmail via Firefox. I have Vista installed on the pc and Windows 7 on the laptop, but cannot access all the features of Hotmail. I tried to clear the cache and restart Firefox, but I still cannot use Hotmail.

    Not this problem when I go to Internet Explorer.

    Hello, it was noted that the foxit pdf plugin is causing this issue. You can disable this plugin in firefox > addons > plugin until what foxit offers a patch/update for the plugin.

  • How can I get rid of a notice titled "Safari Alert" that tells me to dial a number, but forbidden access to the i - pad

    How can I get rid of a notice titled "Safari Alert" that tells me to dial a number, but forbidden access to the i - pad

    It's a pop-up trying to rip you off. Clear your Safari cache. Settings-> Safari-> erase history and data from the Web site.

  • Accidentally, I used my xp professional on my computer which had xp family on it. my computer says I need to activate windows, but when I click the icon, nothing happens.

    help XP Activation

    Accidentally, I used my xp professional on my computer which had xp family on it.  my computer says I need to activate windows, but when I click the icon, nothing happens.  I can't go back to xp home, he beginning to install on the partition.  How to activate windows when I can't get to the prompt?

    http://www.Microsoft.com/genuine/diag/

    Try this link for activation...

  • How to restrict access to the system.

    Hello

    I thought it is possible to restrict access to the system during the processing of payroll is. The GI company is currently working to, so is distributed departments in a different location across the country during the payroll run payroll users are still transaction, insert/update of the data in the entry of the item, monthly data on the pay to play.

    It is technically possible to restrict access to the system or component during the race entry window? no idea to proceed accordingly?

    Thank you

    Published by: user10893201 on March 3, 2010 07:27

    Hi user;

    Please check:

    Security profile is not limiting access to payroll employees [ID 344649.1]
    How install bank account maintenance and security of access to the account in Release 12 [403975.1 ID]
    Restrict access to security of payroll is not working correctly on the safety profile of set [244652.1 ID]

    Also, check search below:
    http://forums.Oracle.com/forums/search.jspa?threadID=&q=restrict+access+&objid=f475&DateRange=all&userid=&NumResults=15

    It may be useful

    Respect of
    HELIOS

  • Restrict access to the Portlet producer

    I want to restrict access to the Portlet producer.
    I mean, it is supposed that there 5 portlets to the producer.
    I want user1 will have access to only 2 portlets and user2 will have access to another 3 portlets.

    Could you please suggest how to achieve this type of authorization.

    I know everything right and single sign on in WSRP. My hypothesis is to combine these two long I can achieve.

    Thank you

    Bénédicte

    Ah ok
    something like that then?
    http://eDOCS.BEA.com/WLP/docs102/Federation/chap-entitlements.html

  • I get an error 643 since April and unable to install an important update. I tried to download the update, but your instructions on the Web are very confused. It's the only update that gave me problems.

    I get an error 643 since April and unable to install an important update.  I tried to download the update, but your instructions on the Web are very confused.  It's the only update that gave me problems. Remember - this is a public forum so never post private information such as numbers of mail or telephone!

    Ideas:

    • You have problems with programs
    • Error messages
    • Recent changes to your computer
    • What you have already tried to solve the problem

    http://support.Microsoft.com/kb/KB976982

    You receive the error 643 0 x or 0 x 80070643 when you try to install the updates of .NET Framework by using Windows Update or Microsoft Update

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    http://support.Microsoft.com/kb/971058

    How to reset the Windows Update components?

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    If the above does not solve the problem, repost in the appropriate Forum:

    It's updated operating system Vista, upgraded installation and activate Forum.

    You will get the best help for any problem of Update/Service Pack in the Windows Update Forum; the link below:

    http://social.answers.Microsoft.com/forums/en-us/vistawu/threads

    When you repost here, kindly include the Error Codes, and exactly what is happening when you try to update.

    In this way, you will receive the best help.

    See you soon.

    Mick Murphy - Microsoft partner

  • Problems with access to the web pages, email, video, etc. even when I have 4-5 bars.

    I installed a Dell Wireless 1505 low-profile carrier 1.2 antenna dim/insp in desktop. Its a PCIe wireless lan card. But since last Tuesday patches have been installed I had problems with access to the web pages, email, video, etc., even when I have 4-5 bars.  Someone at - it an idea of what's going on.

    Hi William e. Swann

    1. what web browser do you use?

    Method 1:

    You can read the following article and check.

    You may experience connectivity problems or performance issues when you connect a portable computer that is running Windows Vista or Windows 7 to a wireless access point

    Method 2:

    You can also read the following article.

    How to troubleshoot network connectivity problems in Internet Explorer

    Hope this information is useful.

  • N3048 access to the Web Interface without OOB

    I recently had our switch replaced by RMA and have access to the web interface via oob. I'm not sure how to access ports and other subnets and want to access the web interface of the server room outside. It's probably something very obvious, but I don't have the original switch to check the configuration. Any help would be appreciated. Thank you.

    You can use in-band or oob access to administration from inside or outside the server room.  The port of oob is a completely separate network used for management only, but you can also use a port in the Strip management.  By default, VLAN 1 is usually used in the Strip to transport of management traffic.  If you set an IP address on VLAN 1 you should also be able to manage from this IP address.  Measures would be to define the IP address on VLAN 1, ping ping to test connectivity, remote and then use your browser to connect to the web INTERFACE.  You should be able to use the same username/password that was used for the oob port.  Without a set of name of user and password, the web INTERFACE will not allow the session.

    B

  • The accessibility of the Web APEX is consistent?

    I am referring to the Web Content Guidelines of the accessory (http://www.w3.org/TR/WCAG20/).

    For most of the projects of governance, the requirement is that any application is supported - the accessibility of the web. This means, it doesn't have to be unencumbered, but that of alternatives not indicated if any user has some disadvantage (disability or some options turned off, etc.) and cannot use a special function.

    I would like to know if anyone has experience with the type of action must be taken to ensure that an ApEX application is «supported web accessibility» Y at - there no official statement on this subject and the Apex Oracle?

    I have my doubts about the use of
    * Icons = > may depend on the theme, but is always a text alternative for the included icons?
    * JavaScript = > APEX Will still work if JavaScript is disabled?
    * Cookies = > I think apex may work with sessions of the url instead of using cookies. Has anyone ever tried?
    * ...?

    _ applications based on the overview of the requirements of the W3C for browser

    Noticeable

    -Provide non-text content text alternatives.
    -Provide captions and alternatives for audio and video content.
    -Make content adaptable; and make it available to assistive technologies.

    -Use sufficient contrast to make things easy to see and hear.

    Operable

    -Make all the keyboard of accessible features.
    -Give users enough time to read and use content.
    -Do not use the content, causing convulsions.
    -Help users navigate and find content.

    Understandable

    -Make the text readable and understandable.
    -Make content appear and operate predictably.
    -Help users avoid and correct mistakes.

    Robust
    -Maximize compatibility with current and future technologies.

    Published by: W. Sven on September 11, 2009 11:54

    Sven,

    I did some 508 complaint with APEX development in the past, and it is really very easy.

    The mechanism of the apex model makes it easy to make your 508 compliant applications. The only thing to keep in mind when creating applications is that less is more; You may need are reluctant to use jQuery or other frameworks based on JavaScript, because they usually give screen readers a moment difficult.

    The directives that you posted are a good start. There are also a lot of information available online, more precisely at http://www.section508.gov/

    Another thing - we were able to get a couple of disclaimers with some of the more complex pages that we have built, as they were not for all users, but only for a select few users admin.

    I hope this helps!

    -Scott-

    http://spendolini.blogspot.com
    http://sumnertech.com

  • Adobe flash player 11.0 blocks access to the Web site home pages

    Why is Adobe flash player 11.0, allowed to block access to the Web site home pages, until their trash is installed?  They should be prosecuted for punishment of the loss of time by Internet users, who spend countless hours trying to fix their garbage, which takes control of the web and blocks PCs access to their program settings, unless it is done according to their specific updates. N ' ILS OWN INTERNET and everything on it, or what?

    Are you sure he blocked it, or the web page requires Flash Player to see this?

    Most web pages require an element of Adobe Flash Player.

    First of all, try to enable Active Scripting in the areas of Sites Internet Options, security settings, trust.

    You should also add a corrupted on.

    Click Start, type: Internet Options

    Press enter

    Select the "Advanced" tab

    Under reset Internet Explorer settings, click "reset".

    This should restore the Internet Explorer default settings.

    Then reinstall Flash Player

    http://get.Adobe.com/flashplayer/

    ----------

    Flash Player

    Troubleshoot installation of Flash Player for Windows

    http://kb2.Adobe.com/CPS/191/tn_19166.html

    Troubleshooting player stability and performance

    http://blogs.Adobe.com/JD/2010/02/troubleshooting_player_stabili.html

    Uninstaller

    http://kb2.Adobe.com/CPS/141/tn_14157.html

    Flash Player Support Forum

    http://forums.Adobe.com/community/webplayers/flash_player

Maybe you are looking for

  • Satellite P200-1EE PSPB6E: problem of battery and Webcam

    Hiya People, New on the Toshiba Forums here and stuck on a problem I have with this laptop.I have a Satellite P200-1EE model number: PSPB6E 0GM028EN. The election House of Uni a few days ago my refuses to laptop to turn on the laptop on and happening

  • Satellite A300-1EH - windows installer does not work correctly

    Hello, this is my first post on this forum! My windows installer does not work correctly.What should do? Soryy, but I did not now much on computer systems.I have reinstall this installer? I'm waiting for your answers.

  • WNDR4500 has stopped working. Power blinking green Internet Orange

    My WNDR4500 stopped working for the past few weeks. Power LIGHT is green flashing light and Internet LED is Orange fixed. All other lights are dead (2.4 GHz Wifi, 5 GHz Wifi, USB1 and USB2). Ethernet LED turns on but if I connect the router's LAN por

  • House sharing is not showing images?

    I have a 64 gb atv4 First of all, I am disappointed that ICloud photos is not compatible with this new machine. However, he has worked to spread my photos of my iMac that will be sufficiently far, but after the update I can't see pictures under "comp

  • Why my audio output dead missing?

    I had just finished recording a friendly message left by one of my family, using a device called MobilePre USB, which allows me to route audio on my PC via a USB port. I processed the message with a software called Audacity, and the first mp3 I expor