Solved

CISCO ASA Restrict access to SSLVPN Client or WEB VPN based on Radius group from AD.

Posted on 2009-07-01
4
752 Views
Last Modified: 2012-08-13
I currently have the SSLVPN CLIENT and WEBVPN configured to use radius.  What I would like to do is create two AD groups one for the SSLVPN CLIENT users and one for WEBVPN users.  The SSLVPN CLIENT and WEBVPN are configured using separate policies on the ASA.  I can't figure out how to do this without setting up another radius server.
0
Comment
Question by:wlhelp
  • 2
  • 2
4 Comments
 
LVL 77

Expert Comment

by:arnold
ID: 24777690
As part of each on the ASA policy you can define the cisco group.
On the Radius server one of the check items is the group.
i.e. part of the request the ASA in addition to transmitting the username/password/its IP it also sends a "group id" (I think it falls under the vendor specific attribute).

Configuring the IAS such that it uses this parameter as part of the check.

You would need to register with dslreports.net to view this:
http://www.dslreports.com/faq/8420

See if the below is helpful though approaches the same thing by directly querying the AD versus going through a radius server.



0
 

Author Comment

by:wlhelp
ID: 24798730
I've seen other articles point to the group ID.  I can't however under Server 2003 IAS find which attribute to use as "group id" is not present.
0
 
LVL 77

Expert Comment

by:arnold
ID: 24798918
Not sure whether it is provided from the cisco as a Vendor-specific-attribute.
This is what you would use as one of your items.
vendor-specific-attribute=group1, username, password, etc. this is VPN1

vendor-specific-attribute=group2, username, password, etc. this is VPN2.

Check Cisco's site it has many different examples.  You could find an example there or within EE.
0
 

Accepted Solution

by:
wlhelp earned 0 total points
ID: 25250537
Used 2 ISA server instances to get around the issue.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you have an ASA5510 then this sort of thing would be better handled with a CSC Module, however on an ASA5505 thats not an option, and if you want to throw in a quick solution to stop your staff going to facebook during work time, then this is the…
Use of TCL script on Cisco devices:  - create file and merge it with running configuration to apply configuration changes
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

867 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now