Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

WEBVPN Authentication

Hi,

We have setup SSLVPN on a Cisco 3800 to host VPN for IP Communicator (VOIP). IOS = IOS AdvanceSecurity 12.4-15(T) and Cisco Secure ACS v3.0

We have trialed an authentication method by using our existing TACACS+ server to host the AAA for the SSLVPN but the problem is the same user account can login to our routers using the same TACACS+.

Is there a way to permit SSLVPN auth for VOIP use and deny access to our routers using the same AAA server?

1 ACCEPTED SOLUTION

Accepted Solutions

Re: WEBVPN Authentication

As your Tacacs+ is ACS, then you can make use of NAR (Network Access Restriction).

Users will be prompted for username/password if device is configured for the same, but they wont be able to telnet/ssh into the Network Device. But should be able to do VPN.

Please go through what attributes are evaluated for a NAR to be applied,

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_white_paper09186a00801a8fd0.shtml

Regards,

Prem

Please rate if it helps!

7 REPLIES

Re: WEBVPN Authentication

if u are giveing users a pool of IPs through the ssl vpn u can u se an ACL on the outside interface that allow only access to the voip network and deny anything els!

New Member

Re: WEBVPN Authentication

Hi, Thanks for the reply.

The part has been secured. The problem is when they are not using the VPN. Normal ADSL connection and if they know the public IP Address of one router, they can VTY/SSH to it using their TACACS+ account.

VTY has ACL already to only allow our internal network in. SSH is for outside use.

I should have included this on the first message to be more clearer.

Is there a setup on the TACACS+ to deny VTY/SSH use of the accounts?

Thanks

Re: WEBVPN Authentication

in this case you need to use AUth proxy if ur router include IOS firewall feature

this way u can spisify whay ports are allowed and use source and distination IPs.

Re: WEBVPN Authentication

As your Tacacs+ is ACS, then you can make use of NAR (Network Access Restriction).

Users will be prompted for username/password if device is configured for the same, but they wont be able to telnet/ssh into the Network Device. But should be able to do VPN.

Please go through what attributes are evaluated for a NAR to be applied,

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_white_paper09186a00801a8fd0.shtml

Regards,

Prem

Please rate if it helps!

New Member

Re: WEBVPN Authentication

Thanks. I will try this and let you know on the result.

Thanks again for your replies.

Peter

New Member

Re: WEBVPN Authentication

Hi,

Thanks for all your help. NAR works.

Cheers

Peter

Re: WEBVPN Authentication

Prem this is 5+ from me :)

168
Views
5
Helpful
7
Replies
CreatePlease login to create content