troubleshooting Question

How do I limit IP addresses on VPN using Windows 2008 NPS?

Avatar of mis_gsc
mis_gscFlag for United States of America asked on
RoutersNetwork OperationsWindows Server 2008
3 Comments1 Solution1296 ViewsLast Modified:
So I'll try to get all the information in here.

Hardware:
Cisco ASA ver.8.2 - ASDM 6.3
Windows 2008 Server running NPS and AD

Currently I've setup a Connection Profile on the ASA using Radius to authenticate to the NPS/AD server. Everything is working as planned as an admin but what I'm trying to accomplish is limiting IP addresses / servers that some users can hit.

On the Radius server I have 2 profiles: Admin and Staff

The Admin profile (#1) connection condition is
ClientFriendlyName = Radius Client, Nas Port type = VPN, and Windows Group is VPNAdmin
I have my testadmin in this group and when I login I have access to everything.

The Staff profile (#2) connection condition is
ClientFriendlyName = Radius Client, NAS Port Type = VPN and Windows Group is VPNStaff.
I also tried using the IP Filter and put in the internal IP's I want the user to hit.
The test user I login with can access everything, even IP's outside the filter list.

I have set the AD accounts Dial-In tab to use NPS policy's.

So my Question is:

How do I get the VPN profile to recognize the IP filters or am I handling the IP filtering correctly? or is the internal IP address handling on the ASA?

Thanks in advance and let me know if more information is needed. I'm new to the NPS world.
ASKER CERTIFIED SOLUTION
gavving

Our community of experts have been thoroughly vetted for their expertise and industry experience.

Join our community to see this answer!
Unlock 1 Answer and 3 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 3 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros