Anyconnect VPN-Authentication multiple profiles via Single RADIUS/Windows NPS

r.p.leadbetter · ‎05-29-2015

Hi All

Pretty sure this is a stupid question and will be answered immediately but as I am not an experience engineer I need some guidance on this.

I have an ASA that has users connecting via the AnyConnect client, everything works fine either using local authentication or RADIUS.

I have a Windows Server 2012 running NPS and the RADIUS auth works fine.

My problem is that I now want to have multiple AC profiles with different levels of access that are all authed through the NPS Server. So for example I would have the Domain Admins AD group be allowed to access Admins VPN Profile giving access to all subnets, but the Domain Users AD group would only have access to the Client VPN profile, giving them access to client subnets only..

Any pointers on this would be greatly appreciated

Thanks
Richard

Karsten Iwen · ‎05-29-2015

There are multiple ways to achieve that. IMO, the easiest is the following (if there are only a limited amount of different profiles):

Configure multiple access-lists for your differentiated access. These ACLs are not assigned to an interface, they are only used for VPN. Mine are always named "VPN-FILTER-USERS", "VPN-FILTER-ADMINS", "VPN-FILTER-SALES" and so on.
Configure multiple group-policies, one for each user-group. Configure all parameters as needed and add the "vpn-filter value XXX" command with the name of the ACL.
On the NPS, duplicate your VPN-policies as often as needed and add a condition that matches on the user-group. Be aware that these policies are compares top-down. If a user is member of domain-admins and domain-users, the policy for domain-admins need to be above the rule for domain-users.
In each NPS-policy add the radius-attribure "class" (which is #25) with the name of the group-policy on the ASA.

Thats it.

r.p.leadbetter · ‎05-29-2015

Hi Karsten

That looks like a great way to do it. I will have a crack over the weekend.

Thank you very much for your advice.

Richard

jensmarklund · ‎05-19-2016

On the NPS, duplicate your VPN-policies as often as needed and add a condition that matches on the user-group. Be aware that these policies are compares top-down. If a user is member of domain-admins and domain-users, the policy for domain-admins need to be above the rule for domain-users.

So you can't add a user to multiple groups and expect getting multiple access-list assigned to the VPN connection?