ACS secure NT group mappings

[whanson]

I have wireless and vpn users. I have defined two NT groups for this purpose and mapped them to an ACS group. How do I separate the two. Now, if a vpnuser authenticates via a wireless connection, they will get in because I give access via the vpnuser group. Do I need to put the wireless aironet client in a network device group? If so, how do I associate that device group to an acs group. I see where it talks about privelege level but I assumed that had to do with what you can and cannot do from a router exec level thx.

[mhoda]

Hello,

What you need to do is map 2 of your ACS groups with these 2 groups that you have defined in NT domain. You can do that, by going to External User database --> Group Mappings and add 2 group mappings and change all other combination to No Access. Then you can configure NAR, that is Network Access Retrictions, on both of the groups, that is deny Wireless devices (NDG) for the VPN group and vice versa.

I hope this helps. Regards,

Mynul