Cisco FirePOWER ASA 5500 series Configuration Manual page 590

Group Policies
The time-range variable is the name of a set of access hours defined in global configuration mode using
the time-range command. The following example shows how to associate the group policy named
FirstGroup with a time-range policy called 824:
hostname(config)# group-policy FirstGroup attributes
hostname(config-group-policy)# vpn-access-hours value 824
Specify the number of simultaneous logins allowed for any user, using the vpn-simultaneous-logins
Step 2
command in group-policy configuration mode.
hostname(config-group-policy)# vpn-simultaneous-logins
The default value is 3. The range is an integer in the range 0 through 2147483647. A group policy can
inherit this value from another group policy. Enter 0 to disable login and prevent user access. The
following example shows how to allow a maximum of 4 simultaneous logins for the group policy named
FirstGroup:
hostname(config)# group-policy FirstGroup attributes
hostname(config-group-policy)# vpn-simultaneous-logins 4
hostname(config-group-policy)#
Note
Configure the user timeout period by entering the vpn-idle-timeout command in group-policy
Step 3
configuration mode or in username configuration mode:
hostname(config-group-policy)# vpn-idle-timeout {minutes | none}
hostname(config-group-policy)#
The minimum time is 1 minute, and the maximum time is 35791394 minutes. The default is 30 minutes.
If there is no communication activity on the connection in this period, the security appliance terminates
the connection.
A group policy can inherit this value from another group policy. To prevent inheriting a value, enter the
none keyword instead of specifying a number of minutes with this command. The none keyword also
permits an unlimited idle timeout period. It sets the idle timeout to a null value, thereby disallowing an
idle timeout.
The following example shows how to set a VPN idle timeout of 15 minutes for the group policy named
FirstGroup:
hostname(config)# group-policy FirstGroup attributes
hostname(config-group-policy)# vpn-idle-timeout 15
hostname(config-group-policy)#
Step 4 Configure a maximum amount of time for VPN connections, using the vpn-session-timeout command
in group-policy configuration mode or in username configuration mode.
hostname(config-group-policy)# vpn-session-timeout {minutes | none}
hostname(config-group-policy)#
The minimum time is 1 minute, and the maximum time is 35791394 minutes. There is no default value.
At the end of this period of time, the security appliance terminates the connection.
A group policy can inherit this value from another group policy. To prevent inheriting a value, enter the
none keyword instead of specifying a number of minutes with this command. Specifying the none
keyword permits an unlimited session timeout period and sets session timeout with a null value, which
disallows a session timeout.
Cisco Security Appliance Command Line Configuration Guide
30-36
While the maximum limit for the number of simultaneous logins is very large, allowing several
could compromise security and affect performance.
Chapter 30 Configuring Tunnel Groups, Group Policies, and Users
integer
OL-10088-01