Solved

CISCO ASA Restrict access to SSLVPN Client or WEB VPN based on Radius group from AD.

Posted on 2009-07-01
4
778 Views
Last Modified: 2012-08-13
I currently have the SSLVPN CLIENT and WEBVPN configured to use radius.  What I would like to do is create two AD groups one for the SSLVPN CLIENT users and one for WEBVPN users.  The SSLVPN CLIENT and WEBVPN are configured using separate policies on the ASA.  I can't figure out how to do this without setting up another radius server.
0
Comment
Question by:wlhelp
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 78

Expert Comment

by:arnold
ID: 24777690
As part of each on the ASA policy you can define the cisco group.
On the Radius server one of the check items is the group.
i.e. part of the request the ASA in addition to transmitting the username/password/its IP it also sends a "group id" (I think it falls under the vendor specific attribute).

Configuring the IAS such that it uses this parameter as part of the check.

You would need to register with dslreports.net to view this:
http://www.dslreports.com/faq/8420

See if the below is helpful though approaches the same thing by directly querying the AD versus going through a radius server.



0
 

Author Comment

by:wlhelp
ID: 24798730
I've seen other articles point to the group ID.  I can't however under Server 2003 IAS find which attribute to use as "group id" is not present.
0
 
LVL 78

Expert Comment

by:arnold
ID: 24798918
Not sure whether it is provided from the cisco as a Vendor-specific-attribute.
This is what you would use as one of your items.
vendor-specific-attribute=group1, username, password, etc. this is VPN1

vendor-specific-attribute=group2, username, password, etc. this is VPN2.

Check Cisco's site it has many different examples.  You could find an example there or within EE.
0
 

Accepted Solution

by:
wlhelp earned 0 total points
ID: 25250537
Used 2 ISA server instances to get around the issue.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Clarification about access via WAN 6 45
replacing 2811 to ISR 4331 2 48
Cisco RV042G 4 18
Layer 3 Switch Configuration 12 48
This is an article about my experiences with remote access to my clients (so that I may serve them) and eventually to my home office system via Radmin Remote Control. I have been using remote access for over 10 years and have been improving my metho…
How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question