Cisco FirePOWER ASA 5500 series Configuration Manual page 634

Configuring User Attributes
Specifying a "Deny" Message
You can specify the message delivered to a remote user who logs into WebVPN successfully, but has no
VPN privileges by entering the deny-message command in username webvpn configuration mode:
hostname(config-username-webvpn)# deny-message value "message"
hostname(config-username-webvpn)# no deny-message value "message"
hostname(config-username-webvpn)# deny-message none
The no deny-message value command removes the message string, so that the remote user does not
receive a message.
The no deny-message none command removes the attribute from the tunnel group policy configuration.
The policy inherits the attribute value.
The message can be up to 491 alphanumeric characters long, including special characters, spaces, and
punctuation, but not counting the enclosing quotation marks. The text appears on the remote user's
browser upon login. When typing the string in the deny-message value command, continue typing even
if the command wraps.
The default deny message is: "Login was successful, but because certain criteria have not been met or
due to some specific group policy, you do not have permission to use any of the VPN features. Contact
your IT administrator for more information."
The first command in the following example enters username mode and configures the attributes for the
user named anyuser. The subsequent commands enter username webvpn configuration mode and modify
the deny message associated with that user.
hostname(config)# username anyuser attributes
hostname(config-username)# webvpn
hostname(config-username-webvpn)# deny-message value "Your login credentials are OK.
However, you have not been granted rights to use the VPN features. Contact your
administrator for more information."
hostname(config-username-webvpn)
Specifying the Access List to use for WebVPN Connections
To specify the name of the access list to use for WebVPN connections for this user, enter the filter
command in username webvpn configuration mode. To remove the access list, including a null value
created by issuing the filter none command, enter the no form of this command. The no option allows
inheritance of a value from the group policy. To prevent inheriting filter values, enter the filter value
none command.
WebVPN access lists do not apply until you enter the filter command to specify them.
You configure ACLs to permit or deny various types of traffic for this user. You then enter the filter
command to apply those ACLs for WebVPN traffic.
hostname(config-username-webvpn)# filter {value ACLname | none}
hostname(config-username-webvpn)# no filter
hostname(config-username-webvpn)#
The none keyword indicates that there is no webvpntype access list. It sets a null value, thereby
disallowing an access list and prevents inheriting an access list from another group policy.
The ACLname string following the keyword value provides the name of the previously configured access
list.
WebVPN does not use ACLs defined in the vpn-filter command.
Note
Cisco Security Appliance Command Line Configuration Guide
30-80
Chapter 30 Configuring Tunnel Groups, Group Policies, and Users
OL-10088-01