SSL Multiple Tunnel Groups with Multiple group policies

Unanswered Question
Sep 29th, 2009
User Badges:

Hello folks.

Have a query and cant seem to find an answer on the web.

I have configured SSL Clientless VPN on a lab ASA5510, using 2 tunnel groups, one for enginneers and one for staff, mapped to 2 different group policies, each with different customisation. I have mapped the AD groups to the tunnel groups using both ACS and now LDAP (currently in use), both working successfully, using group lock and LDAP map of IETF-Radius-Class to Group name ensures engineers get assigned to the engineers tunnel group and staff get mapped to the staff tunnel group only.

The question i have there a way to use a single tunnel group to map the user based on AD group which will then use the correct Group-policy (1 tunnel group to multiple group-polciies). I have seen examples of doing this with different URLs but want to know if they can all use the same URL and avoid using the drop down list using aliases.

It may be a simple "No" but it would be nice to know how to do it without using the URLs or drop down list. Users are easily confused ......

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
auraza Thu, 10/08/2009 - 14:36
User Badges:
  • Cisco Employee,

Easy. Disable the drop-down list, and use the authentication-server (LDAP or Radius) in the DefaultWEBVPNGroup. By default when you browse to the ASA, it will be using the DefaultWEBVPNGroup. Let LDAP or Radius take care of the rest.

You will get the functionality you are looking for.


PS. If this post was helpful, please rate it.


This Discussion