Cisco ASA 5505 - Manual (Page 1500)

67-74
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 67 Configuring Connection Profiles, Group Policies, and Users
Supporting a Zone Labs Integrity Server
Specifying the Access List for Clientless SSL VPN Sessions
Specify the name of the access list to use for clientless SSL VPN sessions for this group policy or
username by using the filter command in webvpn mode. Clientless SSL VPN access lists do not apply
until you enter the filter command to specify them.
To remove the access list, including a null value created by issuing the filter none command, enter the
no form of this command. The no option allows inheritance of a value from another group policy. To
prevent inheriting filter values, enter the filter value none command.
Access lists for clientless SSL VPN sessions do not apply until you enter the filter command to specify
them.
You configure ACLs to permit or deny various types of traffic for this group policy. You then enter the
filter command to apply those ACLs for clientless SSL VPN traffic.
hostname(config-group-webvpn)# filter {value ACLname | none}
hostname(config-group-webvpn)# no filter
The none keyword indicates that there is no webvpntype access list. It sets a null value, thereby
disallowing an access list and prevents inheriting an access list from another group policy.
The ACLname string following the keyword value provides the name of the previously configured access
list.
Note Clientless SSL VPN sessions do not use ACLs defined in the vpn-filter command.
The following example shows how to set a filter that invokes an access list named acl_in for the group
policy named FirstGroup:
hostname(config)# group-policy FirstGroup attributes
hostname(config-group-policy)# webvpn
hostname(config-group-webvpn)# filter acl_in
hostname(config-group-webvpn)#
Applying a URL List
You can specify a list of URLs to appear on the clientless SSL VPN home page for a group policy. First,
you must create one or more named lists by entering the url-list command in global configuration mode.
To apply a list of servers and URLs for clientless SSL VPN sessions to a particular group policy,
allowing access to the URLs in a list for a specific group policy, use the name of the list or lists you
create there with the url-list command in group-policy webvpn configuration mode. There is no default
URL list.
To remove a list, including a null value created by using the url-list none command, use the no form of
this command. The no option allows inheritance of a value from another group policy. To prevent
inheriting a URL list, use the url-list none command. Using the command a second time overrides the
previous setting:
hostname(config-group-webvpn)# url-list {value name | none} [index]
hostname(config-group-webvpn)# no url-list
Table 67-7 shows the url-list command parameters and their meanings.
Table 67-7 url-list Command Keywords and Variables
Parameter Meaning
index Indicates the display priority on the home page.