How to Temporarily Disable Cisco AnyConnect User from ASDM

ciscocisco-anyconnectcisco-asafirewallvpn

I created user under local users. Now I need to disable the user connecting through VPN for a while only.

Platform is ASA 5512 with ASDM 7.6.

Best Answer

From ASDM:

Choose Configuration > Remote Access VPN > AAA/Local Users > Local Users.
Select the user you want to configure and click Edit.
In the left-hand pane, click VPN Policy.
Specify the number of simultaneous logins by the user as 0 (zero).

From the CLI:

username mydisableduser attributes
 vpn-simultaneous-logins 0

Related Solutions

Cisco ASA VPN – How to Block a Specific Computer from VPN

In general, if you are utilizing Cisco Secure Desktop, this opens up a whole world of options to give you restrictions based on the device.

Just as an example off of the top of my head, you could do the following. I haven't had the opportunity to test this configuration, however I have seen similar configurations in the field.

Create a Group Policy in AD that creates a specific registry entry called VPN-ACCESS (for example) on every desktop that will be accessing the VPN.
Create a security group and disable inheritance of the first Group Policy. In it's place, configure a Group Policy that deletes the VPN-ACCESS registry entry if it exists.
Place all PCs are not allowed to have VPN access into this security group. This step would require some scripting elbow grease to ensure that your "blocked" PC's got put into the security group based on whatever criteria you chose.
In Cisco Secure Desktop, have it evaluate if that registry entry exists, if it doesn't exist then block access.

This would take care of only allowing "known" PCs into the VPN, as well as allowing you to explicitly blacklist PCs.

I'm sure there are other ways to do this as well, and this may not even be the best way by far.

The main thrust is, once you've paid for the Anyconnect Premium licenses and have deployed Cisco Secure Desktop, you're only restrained by your ingenuity with regards to what kind of "better mouse trap" you build.

See the CSD Admin Guide for more information on all of it's bells and whistles.

Cisco ASA 5505 – VPN not able to access certain network

I had to make a similar change recently. I needed to add two additional subnets. Though I used CLI rather than ASDM. With version 9.1, I created some new objects for the subnets and then it was just a matter of adding the additional subnets to the split-tunnel ACL (if used) as well as adding additional NAT rules.

For example:

object network {REMOTE_VPN_USER_SUBNET}
 subnet 10.0.1.0 255.255.255.0
object network {EXISTING_VPN_ACCESSIBLE_SUBNET_1}
 subnet 10.0.2.0 255.255.255.0
object network {NEW_VPN_ACCESSIBLE_SUBNET_2}
 subnet 10.0.3.0 255.255.254.0
object network {NEW_VPN_ACCESSIBLE_SUBNET_3}
 subnet 10.0.4.0 255.255.255.0

split-tunnel-network-list value {YOUR_SPLIT-TUNNEL_LIST}
access-list {YOUR_SPLIT-TUNNEL_LIST} standard permit 10.0.1.0 255.255.255.0 
access-list {YOUR_SPLIT-TUNNEL_LIST} standard permit 10.0.2.0 255.255.255.0 
access-list {YOUR_SPLIT-TUNNEL_LIST} standard permit 10.0.3.0 255.255.255.0 

nat (RELEVANT_INTERFACE_OR_VLAN_NAME,outside) source static {EXISTING_VPN_ACCESSIBLE_SUBNET_1} {EXISTING_VPN_ACCESSIBLE_SUBNET_1} destination static {REMOTE_VPN_USER_SUBNET} {REMOTE_VPN_USER_SUBNET} no-proxy-arp route-lookup
nat (RELEVANT_INTERFACE_OR_VLAN_NAME,outside) source static {NEW_VPN_ACCESSIBLE_SUBNET_2} {NEW_VPN_ACCESSIBLE_SUBNET_2} destination static {REMOTE_VPN_USER_SUBNET} {REMOTE_VPN_USER_SUBNET} no-proxy-arp route-lookup
nat (RELEVANT_INTERFACE_OR_VLAN_NAME,outside) source static {NEW_VPN_ACCESSIBLE_SUBNET_3} {NEW_VPN_ACCESSIBLE_SUBNET_3} destination static {REMOTE_VPN_USER_SUBNET} {REMOTE_VPN_USER_SUBNET} no-proxy-arp route-lookup