Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ASA Remote Access Tunnels and AD Authorization

I am doing a demo of an ASA to implelment as an SSL VPN solution, and am having a problem with the configuration.

I have my users being Authenticated with RSA and Authorized with AD/LDAP. I am trying to set it up so that when they are Authorized via AD/LDAP that users get applied on or another ASA Tunnel Group based on AD Group membership.

For example we would want the IT Group to get the full tunnel while other users say in HR would only get to browse certain bookmark links via the portal page.

9 REPLIES
Bronze

Re: ASA Remote Access Tunnels and AD Authorization

Tunnel groups identify the group policy for a specific connection. If you do not assign a particular group policy to a user, the default group policy for the connection applies. Refer the following URL for more info

http://www.cisco.com/en/US/products/ps6121/products_configuration_guide_chapter09186a00806a81e3.html#wp1042067

New Member

Re: ASA Remote Access Tunnels and AD Authorization

I understand about applying a group policy to a user or a group of users. But when user 'Joe' belongs to the 'accounting' group in AD, and user 'Bob' belongs to the 'HR' group in AD the ASA can't see that 'Bob' is logging in to the ASA so then the ASA knows that 'Bob' gets applied to the 'HR' tunnel group. Bob has to make this selection himself when he logs in by selecting which tunnel group he logs into. We want to take that process out of the users hands.

Re: ASA Remote Access Tunnels and AD Authorization

Hi

This is exacly my problem as well, but I would like to match a OU defined in a RA personal certificate to an group name in LDAP(Authorization) with specific access rights applied on group level.

Any url or help is appriciated.

/Brgds Stefan

New Member

Re: ASA Remote Access Tunnels and AD Authorization

I have communicated this issue with my Cisco Security Engineer assigned to my account and he confirmed that this feature is not yet available. Currently the ASA cannot make a decision based on LDAP attributes as to what access rights to give the user.

New Member

Re: ASA Remote Access Tunnels and AD Authorization

I have it working. The key is to use an attribute-map to map the returned LDAP attribute (memberOf, in my case) to the cVPN3000-IETF-Radius-Class attribute.

The value of the cVPN3000-IETF-Radius-Class attribute determines the name of the group policy applied. In my case I use an internal group policy with the exact name of the Active Directory group.

It only worked after updating to the newest interim release, 7.2.1.19. It was just released on October 2. It seems to work very nicely so far.

New Member

Re: ASA Remote Access Tunnels and AD Authorization

It works for me, too.

I nearly got Crazy in debugging the LDAP and reading the Documentation where I did not find any hint id the Cisco Attributes have to be in the LDAP.

I succeded now with the 7.2.1.19 Release without changing anything in my config. Thanks for the Hint.

New Member

Re: ASA Remote Access Tunnels and AD Authorization

I am having the exact same issue. When I try to authorize against the AD/LDAP server, I get an error:

%ASA-6-113005: AAA user authorization Rejected : reason = Attribute not found

The really odd thing is that if I test authenticating against this same AAA server configuration, it works just fine. I map the memberOf attribute to the class attribute which, in turn, determines the group policy. I just cannot get it to work on authorization.

New Member

Re: ASA Remote Access Tunnels and AD Authorization

I was able to resolve this issue by upgrading from 7.2.1 to 7.2.1.19

New Member

Re: ASA Remote Access Tunnels and AD Authorization

Do you mind posting your configure? I can't seem to be about to test my LDAP setting.

Thanks

284
Views
16
Helpful
9
Replies
CreatePlease login to create content