Group Lock issue, with RADIUS

arnis · ‎02-28-2007

I am trying to what seemes to be an simple issue, but !!!

group lock works with attribute 25, but if a user is sent for example to the default group on the ACS or any group where option 25 is not configured ( or configured to some value not avalable on the ASA ) the group lock policy is not enforced, I.E. the users gets in fine no matter what VPN group he is in

is that normal behavior ??

Cheers

Arni

b.hsu · ‎03-06-2007

this is normal. it's the ASA does the group lock and not ACS. ACS just returns the group-name that the user should be in and the ASA does the checking!!.

ACS only checks the username/password, if they are valid it RETURNS (not check) the OU attribute.

Try this link:

http://www.cisco.com/warp/public/471/altigagroup.html