SSL VPN, ASA, RADIUS and connection profiles

Unanswered Question
Sep 17th, 2009
User Badges:

Hi,

I want to have my MS IAS RADIUS check on the connection profile that a SSL VPN user selected: Users can only authenticate for profiles that match their group membership. But a single user can be allowed to connect to more than one connection profile, so forcing a user into a profile (with the CLASS attribute in the RADIUS Access-accept) does not work.


user jdoe, member of RemoteUsers, can login on RemoteUsersProfile

user bigceo, member of RemoteUsers and of RemoteExecutives, can login on RemoteUsersProfile and on RemoteExecutiveProfile

user bofh, member of RemoteUsers and of RemoteAdmins, can login on RemoteUsersProfile and on RemoteAdminProfile


So the RADIUS needs to know on which connection profile a user wants to log into. Does anybody know where in the RADIUS request the ASA puts the selected connection profile? And how does that show up on an IAS server?


Thanks!

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Richard Burts Fri, 09/18/2009 - 07:36
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Peter


This is an interesting question. For a while I wondered about doing something similar to this. But I have not been able to find any indication that the ASA passes the chosen profile/group in the authentication request to Radius. If someone can show us that this can be done it would be helpful.


HTH


Rick

PETER EIJSBERG Fri, 09/18/2009 - 09:10
User Badges:

I've sniffed the radius request coming from the ASA - there is nothing in there referring to a connection profile. I wonder if this is configurable.

fsmontenegro Sun, 09/20/2009 - 13:14
User Badges:

I'm struggling with *EXACTLY* the same issue. Having the connection profile in the RADIUS request would make perfect sense...


The best I (and Mike, my contact at Cisco) could come up with so far is to use DAP. From an AUTHENTICATION perspective, all of your users (bofh,jdoe,bigceo) can log on to any profile.


But then create DAP entries similar to:

- DAP1:

match ALL of:

connprofile RUProfile

memberof RemoteUsers

- DAP2:

match ALL of:

connprofile REProfile

memberof RemoteExecutives

- DAP3:

match ALL of:

connprofile RAProfile

memberof RemoteAdmins

- DAP4:

Terminate


That way you can use DAP to enforce ACLs.


Hope this helps...


Let me know if you come up with anything else. I'm dealing with the same issue here...

sbader48220 Mon, 09/21/2009 - 10:23
User Badges:

Why not use LDAP authentication back to your active directory (I'm assuming you're using AD because you're using IAS)? Using LDAP authentication will allow you to restrict access via groups in AD.


-Steve

Actions

This Discussion