Concentrator 3015 - Can you lock clients down by PORT?

Question

I have a 3015 setup and have created a tunnel, which works fine. I also have it locked down to specific IP addresses.
My question is, Can you lock the cleints down to only a few specific ports? (ex. port 3389 only)

Answer 1

Yes, you can. There are a few steps that you need to take in order to do this. In a nutshell, you need to define a set of rules, create a filter, and then apply the filter to the group.
To create the rules, go to: Configuration->Policy Management->Traffic Management->Rules
Here is a link that discusses rules within the concentrator. If you scroll down the page a bit, the section below this one walks you through the process to create the rules. Take a look at some of the default rules that are configured. One thing to keep in mind is that you need to define rules for the return traffic as well unless you want to use some of the default rules to allow all outbound traffic going back to the clients.
http://www.cisco.com/univercd/cc/td/doc/product/vpn/vpn3000/3_6/config/polmgt.htm#1321359
Once you have your rules defined, you need to setup a filter. The filter is nothing more than a group that allows all of the rules you have defined to be associated together. The link below talks about filters and the section below talks about adding a new filter. To create the filter go to Configuration->Policy Management->Traffic Management->Filters
http://www.cisco.com/univercd/cc/td/doc/product/vpn/vpn3000/3_6/config/polmgt.htm#1321359
Once you have your filter defined, you need to associate it to a group. This is done in Configuration->User Management->Groups, selecting the group to apply the filter to and modifying the group. On the General tab for the group being modified, there is an option to associate a filter to the group. Select the filter you setup and apply your changes.
I would setup a test group to allow you to get comfortable with setting up the rules/filters before implementing them on a production group where you could impact users. This will let you make sure the rules/filter you have setup works the way you expect it to while not impacting any of the production users.
HTH
-Steve