Hi Zane,

Based on my test and research, if you want o to block VPN access for specific addresses in External network, you can
use either of the following ways to do that:

1st Allow VPN on empty network and create specific access rules for PPTP or L2TP

This is the easiest one.
?  Create network named Empty and don't add addresses into it.
?  Allow VPN access on this network only => this way System policy will contain empty network only!
?  Create subnets as you wish and create allow / deny rules for PPTP or for L2TP (and IPSEC - see system policy
created for L2TP for all the protocols that should be allowed to local host)
o    Destination will be Local Host

2nd Create 3 different network objects (not a subnets) for each adapter
?  for each adapter create different network (use Add Adapter button)
?  Select only desired networks in Allowed Networks under VPN properties page


Let's focus on the first method now:

1.             Create network named Empty and don't add addresses into it.

System policy is checked first - so if you will have External network in Allowed VPN networks, users from External
will succeed to connect according to system rule (created and enabled by the 'Verify that VPN Client Access is
Enabled' option. Since the System policy will take precedence over all the user defined policy, if you disable the
'Allow VPN to ISA server' System policy rule, all the user defined 'All VPN' Firewall Access Rule will not take effect.
And that's the reason why I suggest create an empty 'Allow VPN' System policy rule.

1)         Highlight the 'Firewall Policy' node, and then select 'Toolbox' in the right pane.
2)        Select 'Network Objects', highlight 'Networks', and then click 'New', 'Network'.
3)         Give it the name, such as 'Empty', it can be any kind of network (except VPN) with NO address ranges.
Network from type 'External' is fine.


2.            Allow VPN access on this network only => this way System policy will contain empty network only!

You cannot modify the system rule for VPN - it is read-only. Also, the network wizard does not create or modify other
rules except the system one. You should click on "Select Access Networks" on the Tasks bar of VPN and deselect all
except Empty.

Note: Clicking on "Select Access Networks" under VPN and trying to remove all the networks  will fail. This UI is
directly mapped to system rules for VPN (roaming access and PPTP/L2TP Site to Site). So you need to leave there
something - if you want to allow VPN only from specific subnet, you can't - the UI shows only networks there. The
trick is adding Empty network and select it there.


3.            Create subnets as you wish and create allow / deny rules for PPTP or for L2TP.

1)         Create the Subnet objects which contains your desired External IP ranges.

2)        And then, create desired VPN access rules:

a)        For VPN Clients access you should create access rule:

From:        Any kind of network objects (subnets, computers , address ranges, etc ??) of allowed VPN clients
To:            Local Host
Protocols:
o    For PPTP, just add PPTP protocol
o    For L2TP - add the following:
?  L2TP Client
?  IKE Client
?  IPSEC ESP
?  IPSEC NAT-T Client (in case that your VPN clients are behind NAT device/firewall

b)        PPTP/L2TP Site to Site, you should create similar rule:
?
From:        All possible S2S endpoints
To:            Local Host
Protocols:
o    For PPTP, just add PPTP protocol
o    For L2TP - add the following:
?  L2TP Client
?  IKE Client
?  IPSEC ESP
?  IPSEC NAT-T Client (in case that your VPN clients are behind NAT device/firewall

Hope that helps.

Best Regards,

Eric Sun,
MCSE2000 / MSCA / MCDBA
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights
--------------------

<#yTToGaoEHA.324@TK2MSFTNGP11.phx.gbl> <SQWrpGkoEHA.3468@cpmsftngxa06.phx.gbl> <#bf14wkoEHA.2948
@TK2MSFTNGP11.phx.gbl> <1np9hXDpEHA.1520@cpmsftngxa06.phx.gbl>