Cisco ASA Clientless SSL VPN Restrict Network Access

Question

I'm working on a Uni project to set up a secure network. One aspect is to have a VPN for clients of the imaginary company to access web based services.

I have set up a simple clientless SSL VPN which works and gives access to the DMZ with the web server. However it also allows access to other DMZs which I do not want clients accessing.

webvpn
enable outside
exit

How do I go about either directing/restricting the VPN only to a single DMZ? Do I need to use ACLs of some sort or should I be looking at policies based on the usernames or something else entirely?

Answer 1

What you want is called a VPN-filter. It’s just a normal extended ACL, but how you apply it is what makes it a “VPN-filter”.

So, if you want to allow your VPN subnet to only talk with something specific, you would build an ACL such as:

access-list VPN-Filter extended permit tcp 192.168.100.0 255.255.255.0 host 192.168.200.200 eq 3389
access-list VPN-Filter extended deny ip any any

You then apply it to the group-policy that your tunnel-group is set to use. Be careful, though, because unless you set your tunnel-group to use a specific group-policy, it will use the default group-policy, and applying a VPN-filter to that means it will affect all of your tunnels that also use the default policy.

To apply it to a group-policy, you would have something like:

group-policy VPN-Policy internal
group-policy VPN-Policy attributes
 vpn-filter value VPN-Filter

Assuming your tunnel-group IS using the default group-policy, to apply the customized group-policy to your tunnel-group, you would have something like:

tunnel-group WebVPN-Tunnel-Group general-attributes
 default-group-policy VPN-Policy

So you know, anything not defined in a separate group-policy such as what I have above will then fall back to the default policy. For example, if this custom group-policy doesn’t define DNS servers to use but the default policy does, the ones listed in the default policy will be used. If you have DNS servers set in both, the ones in the custom policy will be used (they override the default policy for that specific line item).

Edit: It was my mistake for forgetting on this (and your follow-up question here) that clientless VPN doesn't use vpn-filters like client VPN does, and you have to use a WebType ACL to filter traffic based on either URL or TCP-based destinations.

You can still keep the existing VPN-filter in place in case you want the same filtering on a client as well, but it can't be the same ACL since they're different types, meaning you will have 2 ACLs to maintain if you want to make modifications later. Another caveat is that WebType ACLs can't use objects or object-groups - they need to be literal.

To create a WebType ACL, you can add the following to your policy:

access-list CLIENT-VPN-LIST-WebType webtype permit tcp host 192.168.50.2 eq 3389
access-list CLIENT-VPN-LIST-WebType webtype deny tcp any
access-list CLIENT-VPN-LIST-WebType webtype deny url any

And then to add it to your existing group-policy, you can type:

group-policy CLIENT-VPN-POLICY attributes
 webvpn
  filter value CLIENT-VPN-LIST-WebType

You will need to log out of the VPN portal and back in for it to take effect.