SSL-VPN: Restrict destinations by group?

[#1]

Hi everyone. I' ve been scratching my head on this one: I' d like to restrict what destination IP addresses on the protected network are reachable via ssl-vpn client groups. I thought this would be doable by defining a wide SSL-VPN range, then restricting which addresses were actually assigned on connection via the SSL-VPN group settings (restrict IP tunnel range), and finally creating a SSL-VPN policy which explictly states the source and destinations allowed and assigning the appropriate group(s). It seems as if this should work, but alas; it does not and I' m left banging my head. Everyone SSL-VPN' ing in can access everything on the said protected subnet. What am I missing?

[OnTheEdge]

I' m curious, did MR4 actually simplified this ? H@ns

[OnTheEdge]

Hello, just to let you know that I' ve used this procedure to restrict some users to some IP address in our network. But in our case, users are authenticated thru our RSA Secure ID appliance. It works great but it involves a lot of manual work. I just hope they will ease this a bit in a future release. H@ns