Cisco ASA Series User Manual

1-49
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Connection Profiles, Group Policies, and Users
Group Policies
Note The ACE access-list vpnfilt-ra permit 10.10.10.1 255.255.255.255 192.168.1.0
255.255.255.0 eq 23
allows the local network to initiate a connection to the Remote Access
client on any TCP port if it uses a source port of 23. The ACE
access-list vpnfilt-ra permit
10.10.10.1 255.255.255.255 eq 23 192.168.1.0 255.255.255.0
allows the Remote Access
client to initiate a connection to the local network on any TCP port if it uses a source port of 23.
In the next example, the vpn-filter is used with a LAN to LAN VPN connection. This example assumes
that the remote network is 10.0.0.0/24 and the local network is 192.168.1.0/24.
The following ACE will allow remote network to telnet to the local network:
hostname(config-group-policy)# access-list vpnfilt-l2l permit 10.0.0.0 255.255.255.0
192.168.1.0 255.255.255.0 eq 23
The following ACE will allow the local network to telnet to the remote network:
hostname(config-group-policy)# access-list vpnfilt-l2l permit 10.0.0.0 255.255.255.0 eq 23
192.168.1.0 255.255.255.0
Note The ACE access-list vpnfilt-l2l permit 10.0.0.0 255.255.255.0 192.168.1.0
255.255.255.0 eq 23
allows the local network to initiate a connection to the remote network
on any TCP port if it uses a source port of 23. The ACE
access-list vpnfilt-l2l permit
10.0.0.0 255.255.255.0 eq 23 192.168.1.0 255.255.255.0
allows the remote network to
initiate a connection to the local network on any TCP port if it uses a source port of 23.
Specifying a NAC Policy for a Group Policy
This command selects the name of a Network Admission Control policy to apply to this group policy.
You can assign an optional NAC policy to each group policy. The default value is --None--.
Prerquisite
Create a NAC policy. See Configuring Network Admission Control, page 73-1.
Detailed Steps
Command Purpose
Step 1
group-policy value attributes
Example:
hostname> en
hostname# config t
hostname(config)# group-policy FirstGroup attributes
hostname(config-group-policy)#
Enter group policy configuration mode.
Step 2
nac-settings value nac-policy-name
Example:
hostname(config-group-policy)# nac-settings value
nac-policy-1
hostname(config-group-policy)#
Assigns the NAC policy named nac-policy-1 to the
FirstGroup group policy.

Cisco ASA Series Specifications

General

Brand	Cisco
Model	ASA Series
Category	Network Hardware
Language	English