Client Authentication VPN3000

[henrysacco]

I have a VPN concentrator that is configured for client authentication using an NT domain. I dont want every account in Active Directory to have VPN access, so i was wondering if it was possible to limit the scope of where the vpn 3000 looks for accounts to authenticate. Can it be limited to a particular organiztional Unit in Active Directory?

[kerry.whittaker]

You may have to use ACS. It can check the windows groups and dial-in settings. then replay to the VPN server correctly.

[jjkruege]

You would have to use Radius. Microsoft's built in IAS would do the trick. It can allow you to specify a group that can access the VPN. I'm not sure if it can match on an OU though... Maybe. You might also have to be in Native mode for some of that to work.