We currently are using LDAP to authenticate users accessing an ASA. We enforce usage of the AnyConnect client by mapping the msNPAllowDialIn LDAP attribute to the Cisco Tunneling-Protocols attribute. "Deny Access" in the A/D Dial-In tab of the user equates to a value of 0 sent to Tunneling-Protocols, which keeps non-authorized users from accessing. "Allow Access" is mapped to a "32" which enforces the use of the AnyConnect client. All is well and this works perfectly.
Now we want to create a second category of users. These users will be allowed access, but we want to use Clientless VPN, and we want to only allow TCP port forwarding to 3389 (you can see where this is going). I understand that I can map an LDAP attribute "memberOf" with a value of "VPN-RDPOnly" to the IETF-Radius-Class ASA attribute and apply a group policy of that same name which would do the trick. My question is, can I have both? I'd like to keep the "Tunneling-Protocols" attribute (which I know would have to change to 48) so that I can quickly turn off anyone I want to by allowing and disallowing through the group policy dial-in tab. But, I'd also like to have another attribute that determines which group policy is applied. So, for a given user, can the ASA evaluate both attributes (tunneling-protocols for access authorization and IETF-radius-class for policy assignment)?
DocumentationCode download linksGoalRequirementLimitationsSupported ISR
and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationConfigure one of the connectivity
options to access the Cisco IMC from the n...
Firepower Threat Defense (NGFWv) on UCS E-series - Transparent Mode in
HA DocumentationCode download linksGoalRequirementLimitationsSupported
ISR and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationCo...
Question I am currently unable to specify "crypto keyring" command when
configuring VPN connection on my cisco 2901 router. The following
licenses have been activated on my router :