Solved: WEBVPN Authentication

Peter Valdes · ‎08-20-2008

Hi,

We have setup SSLVPN on a Cisco 3800 to host VPN for IP Communicator (VOIP). IOS = IOS AdvanceSecurity 12.4-15(T) and Cisco Secure ACS v3.0

We have trialed an authentication method by using our existing TACACS+ server to host the AAA for the SSLVPN but the problem is the same user account can login to our routers using the same TACACS+.

Is there a way to permit SSLVPN auth for VOIP use and deny access to our routers using the same AAA server?

Premdeep Banga · ‎08-22-2008

As your Tacacs+ is ACS, then you can make use of NAR (Network Access Restriction).

Users will be prompted for username/password if device is configured for the same, but they wont be able to telnet/ssh into the Network Device. But should be able to do VPN.

Please go through what attributes are evaluated for a NAR to be applied,

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_white_paper09186a00801a8fd0.shtml

Regards,

Prem

Please rate if it helps!

View solution in original post

Marwan ALshawi · ‎08-21-2008

if u are giveing users a pool of IPs through the ssl vpn u can u se an ACL on the outside interface that allow only access to the voip network and deny anything els!

Peter Valdes · ‎08-21-2008

Hi, Thanks for the reply.

The part has been secured. The problem is when they are not using the VPN. Normal ADSL connection and if they know the public IP Address of one router, they can VTY/SSH to it using their TACACS+ account.

VTY has ACL already to only allow our internal network in. SSH is for outside use.

I should have included this on the first message to be more clearer.

Is there a setup on the TACACS+ to deny VTY/SSH use of the accounts?

Thanks

Marwan ALshawi · ‎08-21-2008

in this case you need to use AUth proxy if ur router include IOS firewall feature

this way u can spisify whay ports are allowed and use source and distination IPs.

Premdeep Banga · ‎08-22-2008

As your Tacacs+ is ACS, then you can make use of NAR (Network Access Restriction).

Users will be prompted for username/password if device is configured for the same, but they wont be able to telnet/ssh into the Network Device. But should be able to do VPN.

Please go through what attributes are evaluated for a NAR to be applied,

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_white_paper09186a00801a8fd0.shtml

Regards,

Prem

Please rate if it helps!

Peter Valdes · ‎08-22-2008

Thanks. I will try this and let you know on the result.

Thanks again for your replies.

Peter

Peter Valdes · ‎08-24-2008

Hi,

Thanks for all your help. NAR works.

Cheers

Peter

Marwan ALshawi · ‎08-24-2008

Prem this is 5+ from me :)