Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Radius and AD issue

Hi all,

The scenario as following, I have ASA, ACS appliance v4.1 and Active directory, all the users credentials located on AD and I?m willing to configure the ACS (radius) to manage and restrict the access to internet, I did it successfully in case the credentials created on the ACS's local database but practically all my users accounts created on the AD and I need to find away to group the users on ACS and keep the accounts on AD.

Is it possible!!

Regards,

1 ACCEPTED SOLUTION

Accepted Solutions

Re: Radius and AD issue

Hi,

You only need to configure following :

- Make sure that you have a Remote Agent installed so that your ACS appliance can talk to AD. Beware, Remote Agent version should be exactly the same, as the version of ACS software that you have on your appliance.

- Then you need to configure Group mapping, if you need users discovered from AD to map to a particular group on ACS.

Else, if you don't, all the AD users will be mapped to Default Group on ACS.

- Configure the group the way you want.

Useful links:

Installation/configuration instructions for Remote Agent(they come in 2 flavors, Solaris, Windows):

http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacsapp/csapp41/rase41/index.htm

Windows Database:

http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs41/user/usrdb.htm#wp353636

Group Mapping:

http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs41/user/grpmap.htm

Regards,

Prem

3 REPLIES
Silver

Re: Radius and AD issue

Yes is possible. You have your active directory groups map to ACS groups. You'll need to migrate all of your permissions to the group level since user permissions override group settings. You'll also need to (IMHO) migrate your local users from static on the server to dynamic populated from Active Directory. Be aware that the order in which your groups are listed in ACS matters in AAA, the first match a rule hits is the one it uses.

Re: Radius and AD issue

Hi,

You only need to configure following :

- Make sure that you have a Remote Agent installed so that your ACS appliance can talk to AD. Beware, Remote Agent version should be exactly the same, as the version of ACS software that you have on your appliance.

- Then you need to configure Group mapping, if you need users discovered from AD to map to a particular group on ACS.

Else, if you don't, all the AD users will be mapped to Default Group on ACS.

- Configure the group the way you want.

Useful links:

Installation/configuration instructions for Remote Agent(they come in 2 flavors, Solaris, Windows):

http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacsapp/csapp41/rase41/index.htm

Windows Database:

http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs41/user/usrdb.htm#wp353636

Group Mapping:

http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs41/user/grpmap.htm

Regards,

Prem

New Member

Re: Radius and AD issue

Hi Prem,

Many thx for your support, I wasted time trying to configure group mapping using LDAP but I found it wasn't supported. I used the windows DB with remote agent and task acomplished successfully.

Regards,

Belal

245
Views
0
Helpful
3
Replies