Configuring Vpn-Specific Attributes - Cisco FirePOWER ASA 5500 series Configuration Manual

Chapter 30 Configuring Tunnel Groups, Group Policies, and Users
hostname(config)# group-policy FirstGroup attributes
hostname(config-group-policy)# wins-server value 10.10.10.15 10.10.10.30
hostname(config-group-policy)#
Specify the primary and secondary DNS servers:
Step 2
hostname(config-group-policy)# dns-server value {ip_address [ip_address] | none}
hostname(config-group-policy)#
The first IP address specified is that of the primary DNS server. The second (optional) IP address is that
of the secondary DNS server. Specifying the none keyword instead of an IP address sets DNS servers to
a null value, which allows no DNS servers and prevents inheriting a value from a default or specified
group policy.
Every time that you enter the dns-server command you overwrite the existing setting. For example, if
you configure DNS server x.x.x.x and then configure DNS server y.y.y.y, the second command
overwrites the first, and y.y.y.y becomes the sole DNS server. The same is true for multiple servers. To
add a DNS server rather than overwrite previously configured servers, include the IP addresses of all
DNS servers when you enter this command.
The following example shows how to configure DNS servers with the IP addresses 10.10.10.15, and
10.10.10.30 for the group policy named FirstGroup:
hostname(config)# group-policy FirstGroup attributes
hostname(config-group-policy)# dns-server value 10.10.10.15 10.10.10.30
hostname(config-group-policy)#
Configure the DHCP network scope:
Step 3
hostname(config-group-policy)# dhcp-network-scope {ip_address | none}
hostname(config-group-policy)#
DHCP scope specifies the range of IP addresses (that is, a subnetwork) that the security appliance DHCP
server should use to assign addresses to users of this group policy.
The following example shows how to set an IP subnetwork of 10.10.85.0 (specifying the address range
of 10.10.85.0 through 10.10.85.255) for the group policy named First Group:
hostname(config)# group-policy FirstGroup attributes
hostname(config-group-policy)# dhcp-network-scope 10.10.85.0

Configuring VPN-Specific Attributes

Follow the steps in this section to configure attributes that set the values of VPN attributes. These
attributes control the access hours, the number of simultaneous logins allowed, the timeouts, the name
of the ACL to use for VPN connections, and the tunnel protocol:
Set the VPN access hours. To do this, you associate a group policy with a configured time-range policy,
Step 1
using the vpn-access-hours command in group-policy configuration mode.
hostname(config-group-policy)# vpn-access-hours value {time-range | none}
A group policy can inherit a time-range value from a default or specified group policy. To prevent this
inheritance, enter the none keyword instead of the name of a time-range in this command. This keyword
sets VPN access hours to a null value, which allows no time-range policy.
OL-10088-01
Cisco Security Appliance Command Line Configuration Guide
Group Policies
30-35