How to seperate the user authentication on pix? (pix login and vpn auth)

[blackswans]

I have a pix and a secure ACS. Users connect to network with VPN on pix. They authenticate with ACS. Also when we telnet or ssh to pix they also authenticate with ACS. How to seperate them ? Im using windows database.

thx

[Premdeep Banga]

map normal users to a separate group on ACS, and admin users to another

And on Normal group, apply NAR (IP-based NAR) to restrict access to all the network devices.

i.e., All AAA Clients, *, *

And do not apply anything on Admin group.

Regards,

Prem

[t4tauseef33]

Hi,

I have the same problem. I have did this one. but strange. ACS users adopt the policy but all the windows/domain users are able to login. How can i restrict the default group users (domain users only)to not login/access the network devices.

[somishra]

Hi,

In ACS under External User Database -- Database Group Mappings -- Windows Database -- Default -- Edit group mapping for Domain : \DEFAULT -- All other combinations -- Select the CiscoSecure Group as No Access -- Submit

tnx,

somishra