topic ASA RADIUS auth request with tunnel-group attribute in Network Access Control

ASA RADIUS auth request with tunnel-group attribute

jkloet — Mon, 11 Mar 2019 03:46:50 GMT

ASA version 8.4(5), AnyConnect clients, Cisco ACS 4.2

I need to pass on (inbound RADIUS attribute) to ACS what tunnel-group is being used to establish a VPN session. I don't see this as an option anywhere ... does anyone know if this is possible?

Thanks, Jeff K

ASA RADIUS auth request with tunnel-group attribute

jan.nielsen — Thu, 15 Aug 2013 19:35:30 GMT

I believe that should be enabled by default on the ASA, however i don' remember what version this was introduced in, but it was quite recent, so maybe your 8.4.5 doesnt send the tunnel-group name in the radius request.

ASA RADIUS auth request with tunnel-group attribute

jkloet — Fri, 16 Aug 2013 11:52:08 GMT

Thanks for that info Jan. I will try a newer version and report back what I find. Jeff K

ASA RADIUS auth request with tunnel-group attribute

jkloet — Fri, 23 Aug 2013 17:22:49 GMT

I discovered the "Tunnel Group Name" attribute was added in ASA 8.4.3 ... see release notes.

It turns out our actual problem is that ACS Windows 4.x does not recognize this new attribute.

I opened a TAC case and hooked up with a great support engineer. She found a patch (put together a while back for another customer) to update an ACS 4.x databse so it will recognizes the Tunnel Group Name attribute.

Thanks Eli!

Jeff K