Group Policies
This section describes group policies and how to configure them. It includes the following sections:
• Default Group Policy, page 30-31
• Configuring Group Policies, page 30-33
A group policy is a set of user-oriented attribute/value pairs for IPSec connections that are stored either internally (locally) on the device or externally on a RADIUS server. The tunnel group uses a group policy that sets terms for user connections after the tunnel is established. Group policies let you apply whole sets of attributes to a user or a group of users, rather than having to specify each attribute individually for each user.
Enter the group-policy commands in global configuration mode to assign a group policy to users or to modify a group policy for specific users.
The security appliance includes a default group policy. In addition to the default group policy, which you can modify but not delete, you can create one or more group policies specific to your environment.
You can configure internal and external group policies. Internal groups are configured on the security appliance's internal database. External groups are configured on an external authentication server, such as RADIUS. Group policies include the following attributes:
• Identity
• Server definitions
|
• Client firewall settings |
|
|
• Tunneling protocols |
|
|
• IPSec settings |
|
|
• Hardware client settings |
|
|
• Filters |
|
|
• Client configuration settings |
|
|
• WebVPN functions |
|
|
• Connection settings |
|
|
Default Group Policy |
|
|
The security appliance supplies a default group policy. You can modify this default group policy, but you cannot delete it. A default group policy, named DfltGrpPolicy, always exists on the security appliance, but this default group policy does not take effect unless you configure the security appliance to use it. When you configure other group policies, any attribute that you do not explicitly specify takes its value from the default group policy. To view the default group policy, enter the following command: |
|
|
hostname(config)# show running-config all group-policy DfltGrpPolicy hostname(config)# |
|
|
To configure the default group policy, enter the following command: |
|
|
hostname(config)# group-policy DfltGrpPolicy internal hostname(config)# |
|
|
Note |
The default group policy is always internal. Despite the fact that the command syntax is hostname(config)# group-policy DfltGrpPolicy{internal|external}, you cannot change the type to external. |
|
To change any of the attributes of the default group policy, use the group-policy attributes command to enter attributes mode, then specify the commands to change whatever attributes that you want to modify: |
|
|
hostname(config)# group-policy DfltGrpPolicy attributes |
|
|
Note |
The attributes mode applies only to internal group policies. |
|
The default group policy, DfltGrpPolicy, that the security appliance provides is as follows: |
|
|
group-policy DfltGrpPolicy internal group-policy DfltGrpPolicy attributes banner none wins-server none dns-server none dhcp-network-scope none vpn-access-hours none vpn-simultaneous-logins 2000 vpn-idle-timeout none vpn-session-timeout none vpn-filter none |
|
|
Cisco Security Appliance Command Line Configuration Guide g |
|
|
1 0L-10088-02 |
|
vpn-tunnel-protocol IPSec webvpn password-storage enable ip-comp disable re-xauth disable group-lock none pfs disable ipsec-udp disable ipsec-udp-port 10000 split-tunnel-policy tunnelall split-tunnel-network-list none default-domain none split-dns none intercept-dhcp 255.255.255.255 disable secure-unit-authentication disable user-authentication disable user-authentication-idle-timeout 3 0 ip-phone-bypass disable leap-bypass disable nem disable backup-servers keep-client-config msie-proxy server none msie-proxy method no-modify msie-proxy except-list none msie-proxy local-bypass disable nac disable nac-sq-period 300 nac-reval-period 3 6000 nac-default-acl none address-pools value vpn_users client-firewall none client-access-rule none webvpn functions url-entry file-access file-browsing html-content-filter none homepage none keep-alive-ignore 4
http-comp gzip filter none url-list value MyURLs customization value DfltCustomization port-forward none port-forward-name value Application Access sso-server none deny-message value Login was successful, but because certain criteria have not been met or due to some specific group policy, you do not have permission to use any of the VPN features. Contact your IT administrator for more information svc none svc keep-installer none svc keepalive none svc rekey time none svc rekey method none svc dpd-interval client none svc dpd-interval gateway none svc compression deflate no vpn-nac-exempt hostname(config-group-policy)#
You can modify the default group policy, and you can also create one or more group policies specific to your environment.
Continue reading here: Configuring WINS and DNS Servers
Was this article helpful?