SSL VPN, ASA, RADIUS and connection profiles

PETER EIJSBERG · ‎09-17-2009

Hi,

I want to have my MS IAS RADIUS check on the connection profile that a SSL VPN user selected: Users can only authenticate for profiles that match their group membership. But a single user can be allowed to connect to more than one connection profile, so forcing a user into a profile (with the CLASS attribute in the RADIUS Access-accept) does not work.

user jdoe, member of RemoteUsers, can login on RemoteUsersProfile

user bigceo, member of RemoteUsers and of RemoteExecutives, can login on RemoteUsersProfile and on RemoteExecutiveProfile

user bofh, member of RemoteUsers and of RemoteAdmins, can login on RemoteUsersProfile and on RemoteAdminProfile

So the RADIUS needs to know on which connection profile a user wants to log into. Does anybody know where in the RADIUS request the ASA puts the selected connection profile? And how does that show up on an IAS server?

Thanks!

Richard Burts · ‎09-18-2009

Peter

This is an interesting question. For a while I wondered about doing something similar to this. But I have not been able to find any indication that the ASA passes the chosen profile/group in the authentication request to Radius. If someone can show us that this can be done it would be helpful.

HTH

Rick

HTH

Rick

PETER EIJSBERG · ‎09-18-2009

I've sniffed the radius request coming from the ASA - there is nothing in there referring to a connection profile. I wonder if this is configurable.

PETER EIJSBERG · ‎09-18-2009

Well, got an anwer from TAC: It is not possible. :-(

fsmontenegro · ‎09-20-2009

I'm struggling with *EXACTLY* the same issue. Having the connection profile in the RADIUS request would make perfect sense...

The best I (and Mike, my contact at Cisco) could come up with so far is to use DAP. From an AUTHENTICATION perspective, all of your users (bofh,jdoe,bigceo) can log on to any profile.

But then create DAP entries similar to:

- DAP1:

match ALL of:

connprofile RUProfile

memberof RemoteUsers

- DAP2:

match ALL of:

connprofile REProfile

memberof RemoteExecutives

- DAP3:

match ALL of:

connprofile RAProfile

memberof RemoteAdmins

- DAP4:

Terminate

That way you can use DAP to enforce ACLs.

Hope this helps...

Let me know if you come up with anything else. I'm dealing with the same issue here...

sbader48220 · ‎09-21-2009

Why not use LDAP authentication back to your active directory (I'm assuming you're using AD because you're using IAS)? Using LDAP authentication will allow you to restrict access via groups in AD.

-Steve