Contractors get no tunnel and no address, only a web portal with bookmarks: the firewall fetches the page for them. Give user carol the portal, with one bookmark to the intranet on SRV.
The simulator ticks each one as soon as the network meets it.
A url-list BOOKMARKS with "Intranet" http://192.168.1.20.
webvpn: enable outside.
Group policy WEB: vpn-tunnel-protocol ssl-clientless, and in its webvpn section url-list value BOOKMARKS. User carol (password Web123) in WEB.
Tunnel-group PORTAL, type remote-access, with default-group-policy WEB and group-alias PORTAL.
On LAP1: webvpn connect 203.0.113.1 user carol password Web123 group PORTAL, then webvpn open http://192.168.1.20. LAP1 still cannot ping SRV: clientless means no tunnel.
