How would you deal with this in the ASA?

[John Blakley]

I have configured ssl vpns using anyconnect on my ASA 5520. I've run into a snag, and I'm not sure the best way to deal with it.

We authenticate vpns through radius. The webvpn is doing the same, but the problem comes in when I'll need to give access to outside vendors. Not every vendor gets access to the same thing. One vendor may need access to 5 servers, another may need access to 5 different ones, etc. I *think* I need to lock these users in a group, but I'm not sure the best way to go about this since I won't be using local accounts.

The tunnel-group is specified to authenticate against the radius server, and it works well, but there's no way for me to say "This AD user gets access to this group, and this one gets access to this other tunnel-group."

Are any of you doing this same type of thing at the moment? I've locked users in groups before on a VPN concentrator, but it was one group. There's going to be many, many people with different needs in this scenario.

Thanks,

John

[JORGE RODRIGUEZ]

Hi John,

You might be able to accomplish it though Dynamic Access Policies - works with LDAP/AD.., personally have not used it yet so this is an educated responce..from what I have read sounds like it might provide you the results for your requirement.

have a look on these two links

See DAP section mid page down

http://www.cisco.com/en/US/docs/security/asa/asa80/asdm60/ssl_vpn_deployment_guide/deploy.html

DAP deployment in general

http://www.cisco.com/en/US/products/ps6120/products_white_paper09186a00809fcf38.shtml

Regards