One of our Customers has a corporate network at three different locations. Let's assume:
- location A: 192.168.1.0/24
- location B: 192.168.2.0/24 and
- location C: 192.168.3.0/24
At each location a Cisco ASA creates a VPN to the others. Location A also establishes a L2TP-Tunnel to connect a remote PC which shall access some IP addresses in network B. The IP of the remote PC (10.10.10.1/24) is assigned via a virtual IP pool when the PC is establishing an L2TP connection.
This part is pretty good setup. The Laptop can only access the predefined IP addresses in network B and no others due to our ACLs.
But the PC can access ALL networks on location A - the location where it's L2TP-Tunnel ends up. We also created ACLs for ingoing and outgoing interfaces. But my thought is, since the virtual IPs are something internal of the ASA, you cannot put any ACL on it.
So the question is: How can I deny the acces from the remote PC (10.10.10.1/24) to location A (192.168.1.0/24)? (and keep the connection to location B active (192.168.2.0/24))