Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

What should I do with ACS,Group Setup, "Default Group" ?

Hi,

I've defined ACS groups "Wireless" and "VPN". I created the same groups in active directory and mapped them accordingly on ACS.

Therefore on ACS, "Group Setup", the drop down box lists 3 ACS groups:

"0:Default"

"1:Wireless"

"2:VPN"

At this point should I apply any "deny" configuration on the ACS "Default" group ? If so, can you tell me which configuration should I apply.

My goal is to allow only users who are members of active directory 'wireless' and 'vpn' authenticate and use the respective AAA clients.

Please advise.

3 REPLIES
Gold

Re: What should I do with ACS,Group Setup, "Default Group" ?

You can use network access restriction (NAR) for group settings

Click GROUP SETUP select Default group click EDIT SETTINGS scroll down to Network Access Restrictions (NAR)check DEFINE IP-BASED ACCESS RESTRICTION select ALL AAA CLIENTS and fill asterisk * in fields PORTS and ADDRESS click ENTER

You can do same for CLI/DNIS - based access restriction

Now all users in this group should be denied for accessing to all AAA clients.......

You can also rename Default group to fe. VPN and delete created VPN group a re-map

M.

Hope that helps rate if it does

New Member

Re: What should I do with ACS,Group Setup, "Default Group" ?

Hi,

I didn't understand this portion of the explanation. Can you clarify ?

".... to fe. VPN and delete created VPN group a re-map "

Silver

Re: What should I do with ACS,Group Setup, "Default Group" ?

You dont really need to do anything... Group 0 (Default Group) is no different to the other 499 groups. Its nothing special other than it has a name.

In the ACS group mapping for AD just add another entry that ensures all other AD group memberships get mapped to "No Access"

However, if you want to stop VPN users using WLAN devices (and vice versa) then you will need to add NARs to both ACS groups.

Darran

151
Views
0
Helpful
3
Replies