Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 440)

100

101

25-26

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 25 Configuring Tunnel Groups, Group Policies, and Users

Configuring Users

Construct rules according to these guidelines:

• If you do not define any rules, the security appliance permits all connection types.

• When a client matches none of the rules, the security appliance denies the connection. If you define

a deny rule, you must also define at least one permit rule, or the security appliance denies all

connections.

• For both software and hardware clients, type and version must match exactly their appearance in the

show vpn-sessiondb remote display.

• The * character is a wildcard, which you can enter multiple times in each rule. For example,

client-access rule 3 deny type * version 3.* creates a priority 3 client access rule that denies all

client types running release versions 3.x software.

• You can construct a maximum of 25 rules per group policy.

• There is a limit of 255 characters for an entire set of rules.

• You can enter n/a for clients that do not send client type and/or version.

The following example shows how to create client access rules for the group policy named “FirstGroup”.

These rules permit Cisco VPN clients running software version 4.x, while denying all Windows NT

clients:

hostname(config)# group-policy FirstGroup attributes

hostname(config-group-policy)# client-access-rule 1 deny type WinNT version *

hostname(config-group-policy)# client-access-rule 2 permit “Cisco VPN Client” version 4.*

Note The “type” field is a free-form string that allows any value, but that value must match the fixed

value that the client sends to the security appliance at connect time.

Configuring Users

By default, users inherit all user attributes from the assigned group policy. The security appliance also

lets you assign individual attributes at the user level, overriding values in the group policy that applies

to that user. For example, you can specify a group policy giving all users access during business hours,

but give a specific user 24-hour access.

type type Identifies device types via free-form strings, for example VPN 3002. A

string must match exactly its appearance in the show vpn-sessiondb

remote display, except that you can enter the * character as a wildcard.

version version Identifies the device version via free-form strings, for example 7.0. A string

must match exactly its appearance in the show vpn-sessiondb remote

display, except that you can enter the * character as a wildcard.

Table 25-2 client-access rule Command Parameters (continued)

1 2 ... 435 436 437 438 439 440 441 442 443 444 445 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 440

Kommentare zu diesen Handbüchern