Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

ASA/AnyConnect with 2 LDAP Attributes

We currently are using LDAP to authenticate users accessing an ASA.  We enforce usage of the AnyConnect client by mapping the msNPAllowDialIn LDAP attribute to the Cisco Tunneling-Protocols attribute.  "Deny Access" in the A/D Dial-In tab of the user equates to a value of 0 sent to Tunneling-Protocols, which keeps non-authorized users from accessing.  "Allow Access" is mapped to a "32" which enforces the use of the AnyConnect client.  All is well and this works perfectly.

Now we want to create a second category of users.  These users will be allowed access, but we want to use Clientless VPN, and we want to only allow TCP port forwarding to 3389 (you can see where this is going).  I understand that I can map an LDAP attribute "memberOf" with a value of "VPN-RDPOnly" to the IETF-Radius-Class ASA attribute and apply a group policy of that same name which would do the trick.  My question is, can I have both?  I'd like to keep the "Tunneling-Protocols" attribute (which I know would have to change to 48) so that I can quickly turn off anyone I want to by allowing and disallowing through the group policy dial-in tab.  But, I'd also like to have another attribute that determines which group policy is applied.  So, for a given user, can the ASA evaluate both attributes (tunneling-protocols for access authorization and IETF-radius-class for policy assignment)?

Hall of Fame Super Gold

ASA/AnyConnect with 2 LDAP Attributes

Wrong forum, post in "Security - VPN". You can move your posting using the Actions panel on the right.

Re: ASA/AnyConnect with 2 LDAP Attributes

All right. Now that the question is in the correct forum according to Paolo, does anyone have an idea?

Sent from Cisco Technical Support iPad App

CreatePlease to create content