I have configured ssl vpns using anyconnect on my ASA 5520. I've run into a snag, and I'm not sure the best way to deal with it.
We authenticate vpns through radius. The webvpn is doing the same, but the problem comes in when I'll need to give access to outside vendors. Not every vendor gets access to the same thing. One vendor may need access to 5 servers, another may need access to 5 different ones, etc. I *think* I need to lock these users in a group, but I'm not sure the best way to go about this since I won't be using local accounts.
The tunnel-group is specified to authenticate against the radius server, and it works well, but there's no way for me to say "This AD user gets access to this group, and this one gets access to this other tunnel-group."
Are any of you doing this same type of thing at the moment? I've locked users in groups before on a VPN concentrator, but it was one group. There's going to be many, many people with different needs in this scenario.
You might be able to accomplish it though Dynamic Access Policies - works with LDAP/AD.., personally have not used it yet so this is an educated responce..from what I have read sounds like it might provide you the results for your requirement.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...