An engineer configures the Group URL feature on a Cisco Secure Firewall ASA. The requirement is to place contractors using Cisco Secure Client to access the network into a limited access group…

A group-policy defines VPN attributes applied within a tunnel group but is not directly referenced by name in a Group URL path.

A vpn-filter is an ACL used to restrict traffic for VPN users after they connect and is not referenced in a Group URL.

The IP address identifies the ASA endpoint in the URL hostname, but the specific group identifier used in the URL path to direct users to a tunnel group is the group-alias, not an IP address.

When configuring the Group URL feature, the URL path must reference the group-alias configured on the tunnel group. When a Cisco Secure Client user connects to that URL, the ASA uses the group-alias in the path to identify the correct tunnel group, automatically placing the user into the associated group policy without requiring manual selection. This allows contractors to be seamlessly directed to a limited-access group policy.