Cisco 500 Series, Configuration Manual

Page: 677 / 1140

30-61
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 30 Configuring Connection Profiles, Group Policies, and Users
Group Policies
The following example shows how to set a client firewall policy that requires Cisco Intrusion Prevention
Security Agent for the group policy named FirstGroup:
hostname(config)# group-policy FirstGroup attributes
hostname(config-group-policy)#
client-firewall req cisco-security-agent
hostname(config-group-policy)#
Configuring Client Access Rules
Configure rules that limit the remote access client types and versions that can connect via IPSec through
the security appliance by using the
client-access-rule command in group-policy configuration mode.
Construct rules according to these guidelines:
•
If you do not define any rules, the security appliance permits all connection types.
•
When a client matches none of the rules, the security appliance denies the connection. If you define
a deny rule, you must also define at least one permit rule; otherwise, the security appliance denies
all connections.
• For both software and hardware clients, type and version must exactly match their appearance in the
show vpn-sessiondb remote display.
•
The * character is a wildcard, which you can enter multiple times in each rule. For example,
client-access rul e 3 deny type * version 3.* creates a priority 3 client access rule that denies all
client types running release versions 3.x software.
• You can construct a maximum of 25 rules per group policy.
•
There is a limit of 255 characters for an entire set of rules.
•
You can enter n/a for clients that do not send client type and/or version.
To delete a rule, enter the no form of this command. This command is equivalent to the following
command:
hostname(config-group-policy)# client-access-rule 1 deny type "Cisco VPN Client" version
4.0
To delete all rules, enter the no client-access-rule command without arguments. This deletes all
configured rules, including a null rule if you created one by issuing the client-access-rule command with
the none keyword.
By default, there are no access rules. When there are no client access rules, users inherit any rules that
exist in the default group policy.
To prevent users from inheriting client access rules, enter the client-access-rule command with the none
keyword. The result of this command is that all client types and versions can connect.
hostname(config-group-policy)# client-access rule priority { permit | deny } type type
version { version | none }
hostname(config-group-policy)# no client-access rule [ priority { permit | deny } type type
version version ]
Table 30-3 explains the meaning of the keywords and parameters in these commands.