I'm working on a Uni project to set up a secure network. One aspect is to have a VPN for clients of the imaginary company to access web based services.

I have set up a simple clientless SSL VPN which works and gives access to the DMZ with the web server. However it also allows access to other DMZs which I do not want clients accessing.

enable outside

How do I go about either directing/restricting the VPN only to a single DMZ? Do I need to use ACLs of some sort or should I be looking at policies based on the usernames or something else entirely?

  • 3
    By default, VPN clients are considered "inside". (but confusingly, the traffic is from "outside".) ACLs are the safest bet.
    – Ricky
    Nov 16, 2021 at 20:24

1 Answer 1


What you want is called a VPN-filter. It’s just a normal extended ACL, but how you apply it is what makes it a “VPN-filter”.

So, if you want to allow your VPN subnet to only talk with something specific, you would build an ACL such as:

access-list VPN-Filter extended permit tcp host eq 3389
access-list VPN-Filter extended deny ip any any

You then apply it to the group-policy that your tunnel-group is set to use. Be careful, though, because unless you set your tunnel-group to use a specific group-policy, it will use the default group-policy, and applying a VPN-filter to that means it will affect all of your tunnels that also use the default policy.

To apply it to a group-policy, you would have something like:

group-policy VPN-Policy internal
group-policy VPN-Policy attributes
 vpn-filter value VPN-Filter

Assuming your tunnel-group IS using the default group-policy, to apply the customized group-policy to your tunnel-group, you would have something like:

tunnel-group WebVPN-Tunnel-Group general-attributes
 default-group-policy VPN-Policy

So you know, anything not defined in a separate group-policy such as what I have above will then fall back to the default policy. For example, if this custom group-policy doesn’t define DNS servers to use but the default policy does, the ones listed in the default policy will be used. If you have DNS servers set in both, the ones in the custom policy will be used (they override the default policy for that specific line item).

Edit: It was my mistake for forgetting on this (and your follow-up question here) that clientless VPN doesn't use vpn-filters like client VPN does, and you have to use a WebType ACL to filter traffic based on either URL or TCP-based destinations.

You can still keep the existing VPN-filter in place in case you want the same filtering on a client as well, but it can't be the same ACL since they're different types, meaning you will have 2 ACLs to maintain if you want to make modifications later. Another caveat is that WebType ACLs can't use objects or object-groups - they need to be literal.

To create a WebType ACL, you can add the following to your policy:

access-list CLIENT-VPN-LIST-WebType webtype permit tcp host eq 3389
access-list CLIENT-VPN-LIST-WebType webtype deny tcp any
access-list CLIENT-VPN-LIST-WebType webtype deny url any

And then to add it to your existing group-policy, you can type:

group-policy CLIENT-VPN-POLICY attributes
  filter value CLIENT-VPN-LIST-WebType

You will need to log out of the VPN portal and back in for it to take effect.

  • 2
    If I recall correctly, this can also be set by RADIUS/TACACS+, if that's how the users are authenticated.
    – Ricky
    Nov 16, 2021 at 21:34
  • 1
    @Ricky Correct. You can also then use another feature called group-lock to prevent users that should only access a single VPN profile from logging into a different one (in the cases where the same authentication server is used for multiple).
    – Jesse P.
    Nov 16, 2021 at 21:36
  • 1
    This is awesome, just what I was looking for, thanks!
    – DavidM
    Nov 17, 2021 at 7:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.