I know we can assign role based apps to HTTP(webtop) remote users. How can I do the similar access control for vpn users using a client? Do I have to assign different groups a different IP pool and enforce ACls on the network firewalls to acheieve this?
When you authenticate your remote users with your AD, you can add one more action in the VPE to retrieve the user's group info from the AD. Then, you can assign the different applications on the webtop using the 'Advance Resource Assign' item.
@James_Jinwon_Lee Thanks for your response. What if I don't want to use webtop? Can I place those users in different subnets so I can apply Layer4 acls on APM?
Not 100% sure your environment and objectives, but we can always add some "Variable Assign" to the VPE, and with selecting "Confguration Variable", we can then choose Type: Network Access, Name: <NA_object_name>, and then "Property": we can override the original NA settings, especially if we already have some branching, in the VPE, per the group membership.
Otherwise ... I know we can create some ACLs as an empty sheel, and develop some iRule code to add the ACEs, depending what we need to aloow or deny.
