An engineer is configuring clientless SSL VPN. The finance department has a database server that only they should access, but the sales department can currently access it. The finance and the sales…

Tunnel group lock restricts users to a specific tunnel group connection profile and controls which VPN policy they bind to at login, not which servers they can reach after connecting.

Smart tunnel enables specific thick-client applications to run over the clientless SSL VPN session but does not provide access restriction between different group policies.

Port forwarding enables specific TCP application access for clientless VPN users but is an enablement feature, not a mechanism to restrict access between group policies.

Webtype ACLs are specifically designed for clientless SSL VPN and filter access to URLs, TCP/UDP ports, and network resources for users in a given group-policy. By applying a webtype ACL to the sales group-policy that denies access to the finance database server's address or URL, sales users are blocked from reaching it even though they can authenticate to the VPN. This is the correct and purpose-built feature for cross-department resource restriction in clientless VPN.