Cisco ASA 5505 - Manual (Page 1507)

67-81
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 67 Configuring Connection Profiles, Group Policies, and Users
Configuring User Attributes
Configuring VPN User Attributes
The VPN user attributes set values specific to VPN connections, as described in the following sections.
Configuring Inheritance
You can let users inherit from the group policy the values of attributes that you have not configured at
the username level. To specify the name of the group policy from which this user inherits attributes, enter
the vpn-group-policy command. By default, VPN users have no group-policy association:
hostname(config-username)# vpn-group-policy group-policy-name
hostname(config-username)# no vpn-group-policy group-policy-name
For an attribute that is available in username mode, you can override the value of an attribute in a group
policy for a particular user by configuring it in username mode.
The following example shows how to configure a user named anyuser to use attributes from the group
policy named FirstGroup:
hostname(config)# username anyuser attributes
hostname(config-username)# vpn-group-policy FirstGroup
hostname(config-username)#
Configuring Access Hours
Associate the hours that this user is allowed to access the system by specifying the name of a configured
time-range policy:
To remove the attribute from the running configuration, enter the no form of this command. This option
allows inheritance of a time-range value from another group policy. To prevent inheriting a value, enter
the vpn-access-hours none command. The default is unrestricted access.
hostname(config-username)# vpn-access-hours value {time-range | none}
hostname(config-username)# vpn-access-hours value none
hostname(config)#
The following example shows how to associate the user named anyuser with a time-range policy called
824:
hostname(config)# username anyuser attributes
hostname(config-username)# vpn-access-hours 824
hostname(config-username)#
Configuring Maximum Simultaneous Logins
Specify the maximum number of simultaneous logins allowed for this user. The range is 0 through
2147483647. The default is 3 simultaneous logins. To remove the attribute from the running
configuration, enter the no form of this command. Enter 0 to disable login and prevent user access.
hostname(config-username)# vpn-simultaneous-logins integer
hostname(config-username)# no vpn-simultaneous-logins
hostname(config-username)# vpn-session-timeout alert-interval none
Note While the maximum limit for the number of simultaneous logins is very large, allowing several could
compromise security and affect performance.