Cisco 500 Series, Руководство по настройке

Страница: 662 / 1140

30-46
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 30 Configuring Connection Profiles, Group Policies, and Users
Group Policies
To delete a network list, enter the no form of this command. To delete all split tunneling network lists,
enter the no split-tunnel-network-list command without arguments. This command deletes all
configured network lists, including a null list if you created one by entering the none keyword.
When there are no split tunneling network lists, users inherit any network lists that exist in the default
or specified group policy. To prevent users from inheriting such network lists, enter the
split-tunnel-network-list none command.
The following example shows how to set a network list called FirstList for the group policy named
FirstGroup:
hostname(config)# group-policy FirstGroup attributes
hostname(config-group-policy)# split-tunnel-network-list FirstList
Configuring Domain Attributes for Tunneling
You can specify a default domain name for tunneled packets or a list of domains to be resolved through
the split tunnel. The following sections describe how to set these domains.
Defining a Default Domain Name for Tunneled Packets
The security appliance passes the default domain name to the IPSec client to append to DNS queries that
omit the domain field. When there are no default domain names, users inherit the default domain name
in the default group policy. To specify the default domain name for users of the group policy, enter the
default-domain command in group-policy configuration mode. To delete a domain name, enter the no
form of this command.
hostname(config-group-policy)# default-domain { value domain-name | none }
hostname(config-group-policy)# no default-domain [ domain-name ]
The value domain-name parameter identifies the default domain name for the group. To specify that
there is no default domain name, enter the none keyword. This command sets a default domain name
with a null value, which disallows a default domain name and prevents inheriting a default domain name
from a default or specified group policy.
To delete all default domain names, enter the no default-domain command without arguments. This
command deletes all configured default domain names, including a null list if you created one by
entering the
default-domain command with the none keyword. The no form allows inheriting a domain
name.
The following example shows how to set a default domain name of FirstDomain for the group policy
named
FirstGroup:
hostname(config)# group-policy FirstGroup attributes
hostname(config-group-policy)#
default-domain value FirstDomain
Defining a List of Domains for Split Tunneling
Enter a list of domains to be resolved through the split tunnel. Enter the split-dns command in
group-policy configuration mode. To delete a list, enter the no form of this command.
When there are no split tunneling domain lists, users inherit any that exist in the default group policy.
To prevent users from inheriting such split tunneling domain lists, enter the
split-dns command with the
none keyword.