Cisco FirePOWER ASA 5500 series Configuration Manual page 626

Configuring User Attributes
To remove the attribute from the running configuration, enter the no form of this command. This option
allows inheritance of a time-range value from another group policy. To prevent inheriting a value, enter
the vpn-access-hours none command. The default is unrestricted access.
hostname(config-username)# vpn-access-hours value {time-range | none}
hostname(config-username)# vpn-access-hours value none
hostname(config)#
The following example shows how to associate the user named anyuser with a time-range policy called
824:
hostname(config)# username anyuser attributes
hostname(config-username)# vpn-access-hours 824
hostname(config-username)#
Configuring Maximum Simultaneous Logins
Specify the maximum number of simultaneous logins allowed for this user. The range is 0 through
2147483647. The default is 3 simultaneous logins. To remove the attribute from the running
configuration, enter the no form of this command. Enter 0 to disable login and prevent user access.
hostname(config-username)# vpn-simultaneous-logins integer
hostname(config-username)# no vpn-simultaneous-logins
hostname(config-username)#
While the maximum limit for the number of simultaneous logins is very large, allowing several could
Note
compromise security and affect performance.
The following example shows how to allow a maximum of 4 simultaneous logins for the user named
anyuser:
hostname(config)# username anyuser attributes
hostname(config-username)# vpn-simultaneous-logins 4
hostname(config-username)#
Configuring the Idle Timeout
Specify the idle timeout period in minutes, or enter none to disable the idle timeout. If there is no
communication activity on the connection in this period, the security appliance terminates the
connection.
The range is 1 through 35791394 minutes. The default is 30 minutes. To allow an unlimited timeout
period, and thus prevent inheriting a timeout value, enter the vpn-idle-timeout command with the none
keyword. To remove the attribute from the running configuration, enter the no form of this command.
hostname(config-username)# vpn-idle-timeout {minutes | none}
hostname(config-username)# no vpn-idle-timeout
hostname(config-username)#
The following example shows how to set a VPN idle timeout of 15 minutes for the user named anyuser:
hostname(config)# username anyuser attributes
hostname(config-username)# vpn-idle-timeout 30
hostname(config-username)#
Cisco Security Appliance Command Line Configuration Guide
30-72
Chapter 30 Configuring Tunnel Groups, Group Policies, and Users
OL-10088-01