Cisco PIX 500 Series Configuration Manual page 655

Chapter 30 Configuring Connection Profiles, Group Policies, and Users
The time-range variable is the name of a set of access hours defined in global configuration mode using
the time-range command. The following example shows how to associate the group policy named
FirstGroup with a time-range policy called 824:
hostname(config)# group-policy FirstGroup attributes
hostname(config-group-policy)# vpn-access-hours value 824
Specify the number of simultaneous logins allowed for any user, using the vpn-simultaneous-logins
Step 2
command in group-policy configuration mode.
hostname(config-group-policy)# vpn-simultaneous-logins
The default value is 3. The range is an integer in the range 0 through 2147483647. A group policy can
inherit this value from another group policy. Enter 0 to disable login and prevent user access. The
following example shows how to allow a maximum of 4 simultaneous logins for the group policy named
FirstGroup:
hostname(config)# group-policy FirstGroup attributes
hostname(config-group-policy)# vpn-simultaneous-logins 4
hostname(config-group-policy)#
While the maximum limit for the number of simultaneous logins is very large, allowing several
Note
simultaneous logins could compromise security and affect performance.
Stale AnyConnect, IPSec Client, or Clientless sessions (sessions that are terminated abnormally) might
remain in the session database, even though a "new" session has been established with the same
username.
If the value of vpn-simultaneous-logins is 1, and the same user logs in again after an abnormal
termination, then the stale session is removed from the database and the new session is established. If,
however, the existing session is still an active connection and the same user logs in again, perhaps from
another PC, the first session is logged off and removed from the database, and the new session is
established.
If the number of simultaneous logins is a value greater than 1, then, when you have reached that
maximum number and try to log in again, the session with the longest idle time is logged off. If all
current sessions have been idle an equally long time, then the oldest session is logged off. This action
frees up a session and allows the new login.
Configure the user timeout period by entering the vpn-idle-timeout command in group-policy
Step 3
configuration mode or in username configuration mode:
hostname(config-group-policy)# vpn-idle-timeout {minutes | none}
hostname(config-group-policy)#
The minimum time is 1 minute, and the maximum time is 35791394 minutes. The default is 30 minutes.
If there is no communication activity on the connection in this period, the security appliance terminates
the connection.
A group policy can inherit this value from another group policy. To prevent inheriting a value, enter the
none keyword instead of specifying a number of minutes with this command. The none keyword also
permits an unlimited idle timeout period. It sets the idle timeout to a null value, thereby disallowing an
idle timeout.
The following example shows how to set a VPN idle timeout of 15 minutes for the group policy named
FirstGroup:
hostname(config)# group-policy FirstGroup attributes
hostname(config-group-policy)# vpn-idle-timeout 15
hostname(config-group-policy)#
OL-12172-03
integer
Cisco Security Appliance Command Line Configuration Guide
Group Policies
30-39