Adding a Pair of Access Control Rules for a Cross-Connection
Most of the steps involved in creating an access control rule for a cross-connection are the same as those for
creating a rule for a forward connection or a reverse connection. However, there are some key differences and
For example, to permit your VPN users to call each other using a VoIP application, create one rule for your users
to connect to an IP address pool on the appliance, and a second rule for the IP address pool to connect to the
You would also need to follow this procedure to create a pair of rules to permit bi-directional connections
between an FTP server and users.
To add an access control rule for a cross-connection
Ensure that the requirements for configuring a reverse connection are met. For more information, see Requirements for Reverse and Cross-Connections.
In the AMC, navigate to Security Administration > Access Control.
Click the + (New) icon.
The Add Access Rule page displays.
- Type a number in the Position field to specify the rule’s position in the access rule list. By default, new
rules are added to the top of the list, but you can use this box to place the rule anywhere you want. For
example, if you have four rules and you assign the number
3 to a new one, it is inserted before the
current rule 3 (which will become rule 4). This field is required.
In the Description field, type a descriptive comment about the rule. This step is optional, but a
description can be helpful when viewing your list of rules later. The description also appears in log files
where it is useful when examining logs to determine why a connection did not match a specific rule. The ID is a unique identifier automatically assigned by AMC; it cannot be edited.
Since a cross-connection requires a pair of forward-connection and reverse-connection rules, you should
assign similar names to the two rules to make it easy to locate them in the list of access control rules.
- Use the Action buttons to specify whether the rule will be used to Permit or Deny access, or if the rule is Disabled.
Under Basic settings, use the User and Resource buttons to select forward-connection or
To create a forward-connection rule from the users to the IP address pool, click User.
To create a reverse-connection rule from the IP address pool to the users, click Resource.
In the From field under Basic settings, specify the users or resources to which this rule applies:
For a forward-connection rule, specify the users or user groups to whom the rule applies. Click Edit to select from a list of users or groups. The default value is Any user.
For a reverse-connection rule, specify the address pool that will be used for the VoIP application. Click Edit to select the address pool from a list of resources. The default value is Any resource.
In the To box under Basic settings, specify the users or resources to which this rule applies:
For a forward-connection rule, specify the address pool that will be used for the VoIP application. Click Edit to select the address pool from a list of resources. The default value is Any resource.
For a reverse-connection rule, specify the users to whom the rule applies. Click Edit to select from a list of users or groups. The default value is Any user.
- In the Access method restrictions area, select Any. This enables the appliance’s Smart Access feature to
determine the appropriate access method for the users’ end point devices, which for a reverse
connection is either the Connect Tunnel client or the OnDemand Tunnel agent. The other access
methods do not support cross-connections or bi-directional connections and will be bypassed.
- In the Access method restrictions area, select Any to automatically manage access to all resources in the
rule regardless of the access method making the request. This ensures that either the Connect Tunnel
client or the OnDemand Tunnel agent, which are required for reverse connections, are managed by the
rule. The other access methods do not support reverse connections and will be bypassed.
- Click Finish after you have created the first rule in the pair of cross-connection rule, and then create and
save the second rule. (Alternatively, you can save the first rule in the pair, make a copy of it, and then
reverse the user and resource settings.)
After you have configured the forward-connection rule and the reverse-connection rule that make up the
cross-connection rule pair, you should position the two rules next to each other in the access control list. That
will make it easier to identify them as related rules.
AMC displays an error message if you attempt to create a cross-connection rule with no IP address pools
configured. For more information, see Access Control Rules for Bi-Directional Connections.
Was This Article Helpful?
Help us to improve our support portal