Solved: Radius and AD issue

balsheikh · ‎06-04-2007

Hi all,

The scenario as following, I have ASA, ACS appliance v4.1 and Active directory, all the users credentials located on AD and I?m willing to configure the ACS (radius) to manage and restrict the access to internet, I did it successfully in case the credentials created on the ACS's local database but practically all my users accounts created on the AD and I need to find away to group the users on ACS and keep the accounts on AD.

Is it possible!!

Regards,

Premdeep Banga · ‎06-04-2007

Hi,

You only need to configure following :

- Make sure that you have a Remote Agent installed so that your ACS appliance can talk to AD. Beware, Remote Agent version should be exactly the same, as the version of ACS software that you have on your appliance.

- Then you need to configure Group mapping, if you need users discovered from AD to map to a particular group on ACS.

Else, if you don't, all the AD users will be mapped to Default Group on ACS.

- Configure the group the way you want.

Useful links:

Installation/configuration instructions for Remote Agent(they come in 2 flavors, Solaris, Windows):

http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacsapp/csapp41/rase41/index.htm

Windows Database:

http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs41/user/usrdb.htm#wp353636

Group Mapping:

http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs41/user/grpmap.htm

Regards,

Prem

View solution in original post

akemp · ‎06-04-2007

Yes is possible. You have your active directory groups map to ACS groups. You'll need to migrate all of your permissions to the group level since user permissions override group settings. You'll also need to (IMHO) migrate your local users from static on the server to dynamic populated from Active Directory. Be aware that the order in which your groups are listed in ACS matters in AAA, the first match a rule hits is the one it uses.

Premdeep Banga · ‎06-04-2007

Hi,

You only need to configure following :

- Make sure that you have a Remote Agent installed so that your ACS appliance can talk to AD. Beware, Remote Agent version should be exactly the same, as the version of ACS software that you have on your appliance.

- Then you need to configure Group mapping, if you need users discovered from AD to map to a particular group on ACS.

Else, if you don't, all the AD users will be mapped to Default Group on ACS.

- Configure the group the way you want.

Useful links:

Installation/configuration instructions for Remote Agent(they come in 2 flavors, Solaris, Windows):

http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacsapp/csapp41/rase41/index.htm

Windows Database:

http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs41/user/usrdb.htm#wp353636

Group Mapping:

http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs41/user/grpmap.htm

Regards,

Prem

balsheikh · ‎06-09-2007

Hi Prem,

Many thx for your support, I wasted time trying to configure group mapping using LDAP but I found it wasn't supported. I used the windows DB with remote agent and task acomplished successfully.

Regards,

Belal