What should I do with ACS,Group Setup, "Default Group" ?

[news2010a]

Hi,

I've defined ACS groups "Wireless" and "VPN". I created the same groups in active directory and mapped them accordingly on ACS.

Therefore on ACS, "Group Setup", the drop down box lists 3 ACS groups:

"0:Default"

"1:Wireless"

"2:VPN"

At this point should I apply any "deny" configuration on the ACS "Default" group ? If so, can you tell me which configuration should I apply.

My goal is to allow only users who are members of active directory 'wireless' and 'vpn' authenticate and use the respective AAA clients.

Please advise.

[m.sir]

You can use network access restriction (NAR) for group settings

Click GROUP SETUP select Default group click EDIT SETTINGS scroll down to Network Access Restrictions (NAR)check DEFINE IP-BASED ACCESS RESTRICTION select ALL AAA CLIENTS and fill asterisk * in fields PORTS and ADDRESS click ENTER

You can do same for CLI/DNIS - based access restriction

Now all users in this group should be denied for accessing to all AAA clients.......

You can also rename Default group to fe. VPN and delete created VPN group a re-map

M.

Hope that helps rate if it does

[news2010a]

Hi,

I didn't understand this portion of the explanation. Can you clarify ?

".... to fe. VPN and delete created VPN group a re-map "

[darpotter]

You dont really need to do anything... Group 0 (Default Group) is no different to the other 499 groups. Its nothing special other than it has a name.

In the ACS group mapping for AD just add another entry that ensures all other AD group memberships get mapped to "No Access"

However, if you want to stop VPN users using WLAN devices (and vice versa) then you will need to add NARs to both ACS groups.

Darran