ASA Identity-Based Internet Access

felixnkansah · ‎10-09-2007

Hi,

A client of mine is looking at controlling user access to the Internet based on identity. I know Microsoft ISA and other proxy solutions would do.

However, I am looking at leveraging their present installation of ASA and Microsoft AD to provide them with this function.

I know for sure that the ASA can be used to authenticate users on a web page against the AD and apply access rules accordingly (Identity-Based Access).

Unfortunately, I dont seem to be getting much info on the setup and configuration of this requirement.

If anyone knows of any source, please let me have the links. (I am not referring to authenticating telnet/ssh sessions on the ASA against AD tho).

Regards,

Felix

didyap · ‎10-15-2007

You can use HTTP cut through proxy feature for this. Cut through proxy would give users a log-in prompt when they try to access the web through the ASA. You can configure that login prompt to point to an authentication server. If they have a valid user name and password, it will let them through. If they don't, it will block access from their IP. There are basically two parts of configuration that you will need to do.

1) HTTP Proxy

2) LDAP setup on the ASA

The document link below shows how to configure an ASA to use LDAP as an authentication server

http://www.cisco.com/en/US/docs/security/asa/asa71/configuration/guide/extsvr.html