Limited access to the vpn connection

We have 3 sites connected with the vpn site-to site cisco Pix 515-525-501. We have also 2 cisco 3005 concentrators vpn for users remote access to the system. I have a remote user that needs to connect to one of our servers in order to manage it. Remote users get internal ip address, once they sign in and they get access to all servers and PCs as if they were at the office. Is it possible to block this specific user and give permission to only to a server?

Thank you

Haim defending

[email protected] / * /.

Hello

A much better way to filter traffic is using firewall rules. First, assign a separate group of VPN for your users who need to access that server. Assign a pool to this group.

Then, go to Configuration-> policy Mgmt-> rules: Add a new rule that will be allor traffic from the pool of the group to that specific server (source is the address of the user, the destination is your server). Create another rule for the return shipping.

Create a new filter (Configuration-> policy Mgmt-> filter): Add the two rules created earlier.

Go back to the remote access and then apply the filter itself (you can find the firewall drop-down list in the 'Général' tab) and... VOILA

Rate if all ok.

See you soon.

Tags: Cisco Security

Similar Questions

  • Unable to connect to computers via Remote Desktop on the VPN connection.

    I have a Windows Server 2003 Active Directory network. Connect you to it remotely using an appliance, Sonicwall TZ170 VPN/Firewall DHCP pointing our internal DHCP server so we do not use the Sonicwall DHCP over VPN.

    The area has been recently rebuilt completely charge and the VPN connection was stronger than it has ever been when connecting to computers on our network for the first 2 weeks. In the last few days, however, people had problems connecting on our desktop computers. They can connect to some but not to others, and in the case of a person who needs in particular access to a computer, it can not connect to it all.

    I don't think it's a VPN issue but something to do with the DHCP/DNS/domain controller server. However, I am not able to locate the problem.

    In the past, this same thing was a problem before I took over. We had just a matter to the inconsistency of the connection until I thought I had solved the problem (however short-lived the fix was) with the refurbishment of the domain controller.

    Customers are a mix of Windows XP and Windows 7.

    Any ideas? I will provide all the information I can.

    http://social.technet.Microsoft.com/forums/en-us/category/WindowsServer

    Please repost your question in the above Server Forums.

    Here is the Vista Forums.

    See you soon.

    Mick Murphy - Microsoft partner

  • die remote desktop during the VPN connection

    I by office remote access to a server that is connected by the Cisco VPN client to other servers, but when I connect the VPN, the sector of remote desktop, if I have this connection loose and cannot work.

    That's what I should do, but when the VPN connects, my remote desktop connection matrix:

    |***|                                    |***|                     |***|

    |__|  --> Remote Desktop--> | __ |   --> VPN --> |__|

    me server1 server2

    I can't VPN to server2 directly, I have to go through Server1, but I can't.

    Javier,

    When VPN appears on server1, then all traffic get dug in the client [including the remote desktop session].

    ===> You need a split-mining policy which aims to exclude the IP address of your customer

    See you soon,.

  • How can I connect to my server (which runs on windows server 2008 rc2) via IP REAL using rdp, while the VPN connection is active?

    Hello

    How can I connect to my sServer (which runs on windows server 2008 rc2) via IP REAL using rdp, while the VPN connection is active?

    Hello Marie Smith.

    The question you posted would be better suited in the TechNet Forums. I would recommend posting your query in the link below.

    http://social.technet.Microsoft.com/forums/en-us/winservergen/threads/

    Hope this information helps.

  • Cannot change network over the VPN connection components

    Hi all

    I set up a VPN in windows XP Service Pack 3 with all latest updates.  When I display the properties of the VPN connection, there is a tab labeled "Networking".  When I click on the tab networking that I get an error message pop up that says: "Unable to allow the editing of networkingcomponents at the moment because they are being modified elsewhere."  I restarted and also tried to search and stop the services dealing with virtual private networks, etc. nothing works.

    Can someone help me troubleshoot or identify what prevents me to change my network layout tab?  There is virtually no information on the internet addressing it.

    Thanks in advance!

    Hi Amish_Robot,

    The issue of Windows XP, you have posted is better suited for the IT Pro TechNet public. Please ask your question in the TechNet forums for assistance.

    Hope the helps of information.

    Concerning
    Joel S
    Microsoft Answers Support Engineer
    Visit our Microsoft answers feedback Forum and let us know what you think.

  • can the Internet, have the vpn connection

    can the Internet, have the vpn connection using nat

    can the Internet, have the vpn connection using nat

    Yes, it can.

  • How to start the VPN connection when windows is running

    Original title: trouble with automatically the VPN connection

    Hi, I want to have my VPN connection to start automatically when windows is running.

    Simple version:
    I tried various different methods, including; Paste the shortcut in the startup folder and adding the task in the Task Scheduler.

    I have the same problems with both methods. Just the VPN starts automatically... I have to run it manually whenever I turn on the computer or wake up sleep mode.
    Does anyone know other methods finally a solution for the other two methods?
    In the version of the depth of the problems:

    Method of Task Scheduler: I get argument is not valid, it is even after I have successfully created the task and click OK. The task will not work, and also by some strange reason, my VPN password is not get recorded on my connection more. So now, I need to manually start the connection and type in the password. (I click on save the password whenever this does not work, when the task is active...)

    Shortcut to the startup directory: Simple and easy... It simply doesn't get it. I followed the steps very carefully and I'm 100% sure that I did it the right way...

    These links have good information on how to open a VPN connection to the Windows dΘmarrage

    http://www.dariancabot.com/2010/11/15/automatically-connect-to-VPN-at-Windows-startup/

    http://www.Buchatech.com/2011/04/configure-Windows-to-automatically-connect-to-VPN/

  • Establish the VPN connection before the user logged

    Hello world!

    Anyone know if it is possible to run the cisco vpn client and establish the vpn connection before the user logs (Windows 7)? How?

    Thanks in advance!

    You must Anyconnect VPN.

    use start before logon feature you can get the VPN before windows logon.

    There are a lot of configuration guide that you can find in CISOC regarding anyconnect SBL.

  • Limited access during the trial version?

    Hello! I just installed both Ps and Lr trial versions, I am tempted to play with some of the features that I see mentioned in the start of the tutorials, however the photo, I'm trying to edit does not appear in a visible image size. My question, not the trial version doesn't allow a greater visible image size you work or have limited access to the features until you buy. Thank you...

    Just getting started / beginner

    Photoshop is fully functional throughout the test period.

    You can meet limits to do with a particular image or the hardware that you are using.  For example, some features require the GPU acceleration, and some work only with the highest possible settings of GPU.

  • How to force validation after lost the VPN connection

    Hello

    I did a lot of loading via a VPN connection. That lasted a few hours. Unfortunately the VPN connection has been lost. When you reconnect the VPN connection and connect in the scheme, I don't see all the data. Perhaps the transaction pending and was waiting to be engaged.

    Is it possible to tell the schema, "commit all pending transactions?

    Thanks in advance for any help.

    If your connection to the database has been lost, your session would have been rolled once the database realized he didn't have the client process. There was therefore no transaction on hold to commit at this stage.

    I don't think that there is a parameter that would indicate Oracle to automatically post transactions when the client process is dead - if there were, it would be extremely dangerous, since there is no guarantee that the data is in a consistent state to the point that the customer fails.

    Why are you doing a batch load via a VPN connection, probably from your desktop? Would be unwise to copy the data that you are trying to load a server in the same local network as the database and run the load it? In addition to being much more efficient, it is much easier to leave a job for some time on a server that it should keep a connection from your laptop computer for several hours.

    Justin

  • I'm a wi - fi connection, but "limited access" to the internet - which translates into NO access. I am running Windows Vista. Any help?

    IWAS in a placw with a wi - fi connection, but could not get to the internet. Says limited access. Have never had this problem before and don't know what to do now. I tried through repair ang features, but nothing to do. Any help would be appreciated.

    Hello

    I suggest you refer to the link mentioned the problem below:

    http://Windows.Microsoft.com/en-us/Windows-Vista/troubleshoot-network-connection-problems

    I hope this helps.

  • need help for the VPN connection

    Hi guys

    can you help with that?

    I installed a VPN connection, but the tunnel shows that status: upward and the protocol description: down.

    debugging is turned on and displays following-

    ITS has applications pending (xx.xx.xx.xx local port 500, xx.xx.xx.xx remote port 500)

    DEC 20 02:39:26.762: ISAKMP: (2142): sitting IDLE. From QM immediately (QM_IDLE)

    02:39:26.762 20 Dec: ISAKMP: (2142): start Quick Mode Exchange, M - ID 3357871564

    02:39:26.762 20 Dec: ISAKMP: (2142): initiator QM gets spi

    DEC 20 02:39:26.762: ISAKMP: (2142): Pack xx.xx.xx.xx my_port 500 peer_port 500 (I) sending QM_IDLE

    02:39:26.762 20 Dec: ISAKMP: (2142): sending a packet IPv4 IKE.

    02:39:26.762 20 Dec: ISAKMP: (2142): entrance, node 3357871564 = IKE_MESG_INTERNAL, IKE_INIT_QM

    02:39:26.762 20 Dec: ISAKMP: (2142): former State = new State IKE_QM_READY = IKE_QM_I_QM1

    02:39:26.794 20 Dec: ISAKMP (2142): packet received from xx.xx.xx.xx dport 500 sport Global 500 (I) QM_IDLE

    02:39:26.794 20 Dec: ISAKMP: node set-419503660 to QM_IDLE

    DEC 20 02:39:26.794: ISAKMP: (2142): HASH payload processing. Message ID = 3875463636

    DEC 20 02:39:26.794: ISAKMP: (2142): treatment protocol NOTIFIER PROPOSAL_NOT_CHOSEN 3

    SPI 2561284360, message ID = 3875463636, a = 0x87D0CFC8

    DEC 20 02:39:26.794: ISAKMP: (2142): removal of spi 2561284360 message ID = 3357871564

    02:39:26.794 20 Dec: ISAKMP: (2142): node-937095732 error suppression REAL reason "remove larval.

    02:39:26.794 20 Dec: ISAKMP: (2142): node-419503660 error suppression FALSE reason 'informational (en) State 1.

    02:39:26.794 20 Dec: ISAKMP: (2142): entry = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY

    02:39:26.794 20 Dec: ISAKMP: (2142): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

    02:39:46.798 20 Dec: ISAKMP: (2142): purge the node-1177810765

    02:39:46.798 20 Dec: ISAKMP: (2142): purge the node-138734109

    02:39:56.763 20 Dec: % s-6-IPACCESSLOGRL: the rate limited or missed 2 sachets of access list record

    DEC 20 02:39:56.763: IPSEC (key_engine): request timer shot: count = 2,.

    local (identity) = xx.xx.xx.xx:0, distance = xx.xx.xx.xx:0,

    local_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),

    remote_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4)

    the config is following.

    crypto ISAKMP policy 10

    BA 3des

    preshared authentication

    Group 2

    ISAKMP crypto key xxxxxx address xx.xx.xx.xx

    !

    !

    Crypto ipsec transform-set esp-3des esp-sha-hmac vpnset

    transport mode

    !

    Crypto ipsec tech profile

    Set transform-set vpnset

    !

    !

    my-map 20 ipsec-isakmp crypto map

    defined peer xx.xx.xx.xx

    Set transform-set vpnset

    match address 155

    Hello

    As for your question, you can have more than 1 card crypto on the interface.

    However, you can use the same card encryption for several strategies. You can change the ma-card to vpnmap.
    In this way the two are enabled on the same interface, with one having a higher priority than the other.

    So if a package came from inside, the first crypto ACL interface is checked and then the next and so on. The first match found is chosen for the IPsec negotioation.

  • Satellite L - limited access to the WLAN router

    Hello

    My laptop has stopped all of a sudden to have access to the internet, even if the wireless is turned on. It connects with access limited, so boring. I called technique for service provider to wide band and can't do anything. This is the laptop. When connected says limited and no internet access available. I have disabled the firewall to see if that was the problem but still nothing.

    If his laptop certainly - I tried reinstalling drivers wlan realtech. I'll have to use ethernet cable to connect to the moment.

    Please please help.

    Hi deanplay,

    Unfortunately I think that it s not easy to help you if you don't show your laptop model and operating system information. It is always important to know for an etailed response.

    For the moment I can only recommend to read this section of the FAQ:
    [WiFi: improved reliability of connections | http://forums.computers.toshiba-europe.com/forums/ann.jspa?annID=68]

  • How to set the VPN connection in Windows 7 64 bit?

    Hello

    How can I set up a Vpn connection in Windows 7 x 64 bit.

    Thank you.

    Hello

    Go to the network control panel and Internet-network sharing Center.

    http://www.windows7hacker.com/index.php/2009/08/how-to-set-up-a-VPN-connection-in-Windows-7/

    Note that you need to know the login and the password to access the Internet :)

  • Once the VPN connection is established, cannot ping or you connect other IP devices

    Try to get a RV016 installed and work so that people can work from home.  You will need to charge customers remote both WIN XP and MAC OS X.

    Have the configured router and works fine with the VPN Linksys client for WIN XP users.  Can connect, ping, mount the shared disks, print to printers to intellectual property, etc.

    Can connect to the router fine with two VPN clients third 3 for Mac: VPN Tracker and IPSecuritas.  However, once the connection is established, cannot ping the VPN LinkSYS router or any other IP address on the LAN Office.  Turn the firewall on or off makes no difference.

    Is there documentation anywhere that describes how the LinksysVPN for Windows Client communicates so these can be replicated in 3rd VPN clients from third parties for the Mac in OS X?

    The connection with IPSecuritas and VPN Tracker is performed using a shared key and a domain name.  It is not a conflict of IP address network between the client and the VPN 192.168.0.0/24 network.

    VPN Tracker and IPSecuritas are able to connect to the routers CISCO easy VPN with no poblem.

    Any ideas on how to get the RV016 to work for non-Windows users?

    We found and fixed the problem, so using VPN Tracker or current IPSecuritas on OS X people have access to the LAN via the RV016 machines. The "remote networks" in the screen BASE in VPN Tracker has been set on the entire subnet: 192.168.0.0/255.255.255.0 the in the RV016 has been set to the IP of 192.168.0.1 to 192.168.0.254 range. Even if the addresses are essentially the same, without specifying the full subnet in the RV016 has allowed the connection to do but prevented the VPN client machine to connect because the RV016 would pass all traffic to the Remote LAN. Change the setting of 'local group' in RV016 settings in the screen "VPN/summary/GroupVPN', 'Local Group Zone' for the subnet 192.168.0.0/24 full solved the problem.

Maybe you are looking for