Cisco PIX 500 Series Configuration Manual page 692

Configuring User Attributes
The following example shows how to allow a maximum of 4 simultaneous logins for the user named
anyuser:
hostname(config)# username anyuser attributes
hostname(config-username)# vpn-simultaneous-logins 4
hostname(config-username)#
Configuring the Idle Timeout
Specify the idle timeout period in minutes, or enter none to disable the idle timeout. If there is no
communication activity on the connection in this period, the security appliance terminates the
connection.
The range is 1 through 35791394 minutes. The default is 30 minutes. To allow an unlimited timeout
period, and thus prevent inheriting a timeout value, enter the vpn-idle-timeout command with the none
keyword. To remove the attribute from the running configuration, enter the no form of this command.
hostname(config-username)# vpn-idle-timeout { minutes | none}
hostname(config-username)# no vpn-idle-timeout
hostname(config-username)#
The following example shows how to set a VPN idle timeout of 15 minutes for the user named anyuser:
hostname(config)# username anyuser attributes
hostname(config-username)# vpn-idle-timeout 30
hostname(config-username)#
Configuring the Maximum Connect Time
Specify the maximum user connection time in minutes, or enter none to allow unlimited connection time
and prevent inheriting a value for this attribute. At the end of this period of time, the security appliance
terminates the connection.
The range is 1 through 35791394 minutes. There is no default timeout. To allow an unlimited timeout
period, and thus prevent inheriting a timeout value, enter the vpn-session-timeout command with the
none keyword. To remove the attribute from the running configuration, enter the no form of this
command.
hostname(config-username)# vpn-session-timeout { minutes | none}
hostname(config-username)# no vpn-session-timeout
hostname(config-username)#
The following example shows how to set a VPN session timeout of 180 minutes for the user named
anyuser:
hostname(config)# username anyuser attributes
hostname(config-username)# vpn-session-timeout 180
hostname(config-username)#
Applying an ACL Filter
Specify the name of a previously-configured, user-specific ACL to use as a filter for VPN connections.
To disallow an access list and prevent inheriting an access list from the group policy, enter the vpn-filter
command with the none keyword. To remove the ACL, including a null value created by issuing the
vpn-filter none command, enter the no form of this command. The no option allows inheritance of a
value from the group policy. There are no default behaviors or values for this command.
Cisco Security Appliance Command Line Configuration Guide
30-76
Chapter 30 Configuring Connection Profiles, Group Policies, and Users
OL-12172-03