Technical Forum
Ask questions. Discover Answers.
Showing results for 
Search instead for 
Did you mean: 

How to enforce Role based access controls to VPN users?


I know we can assign role based apps to HTTP(webtop) remote users. How can I do the similar access control for vpn users using a client? Do I have to assign different groups a different IP pool and enforce ACls on the network firewalls to acheieve this?


Community Manager
Community Manager

I've seen@StephanManthey answer similar questions. Maybe he could help here?

F5 Employee
F5 Employee

When you authenticate your remote users with your AD, you can add one more action in the VPE to retrieve the user's group info from the AD. Then, you can assign the different applications on the webtop using the 'Advance Resource Assign' item. 

@James_Jinwon_Lee Thanks for your response. What if I don't want to use webtop? Can I place those users in different subnets so I can apply Layer4 acls on APM?


Not 100% sure your environment and objectives, but we can always add some "Variable Assign" to the VPE, and with selecting "Confguration Variable", we can then choose Type: Network Access, Name: <NA_object_name>, and then "Property": we can override the original NA settings, especially if we already have some branching, in the VPE, per the group membership.

Otherwise ... I know we can create some ACLs as an empty sheel, and develop some iRule code to add the ACEs, depending what we need to aloow or deny.