multiple SSL-VPN profiles

[lauro7]

I have to manage some different SSL-VPN profiles. I would offer to remote user the possibility to choose a VPN profile and then access the enterprise network with different policies. Is it possible ? How can I distinguish between one profile from another ? I suppose I need some IP public addresses to create different SSL portal with different IP, otherwise is it possible distinguish by means of Authentication profiles ?

Thanks.

[spolo]

When you create an SSL VPN profile, you have to choose which tunnel interface it's on.  So maybe one way to distinguish different profiles is by creating security policy around which tunnel interface the user is on, or assigning different zones to those various tunnel interfaces and creating your security policy around those zones.  Then you can monitor and run reports based on zones.

You are correct, in order to have different profiles, you'll have to create different SSL VPN portals.  This will require different interfaces, and you're right, different public IP addresses for the users to point to.  In order to make it easier on your users, and if you have the ability to do so, you might consider hosting a redirect page somewhere, where you'd post a page that gives them descriptions and links to the portals you've created.  You could even leverage the custom SSL VPN portal page directly on the device if that would work for your application!

Hope this makes sense!

[skrall]

You will need 1 IP address for each SSL VPN portal you plan to create. Each portal will assign a different IP address space for users. You can even associate a different zone  with each portal. Each profile can then choose between LocalDB , RADIUS or LDAP for Authentication.  You can not allow HTTPS management of the device on the same IP address as an SSL VPN portal.

Steve Krall