topic Two AAA Identity Groups in Network Access Control

Two AAA Identity Groups

Alex Pfeil — Mon, 11 Mar 2019 03:32:09 GMT

I have some administators that log into switches and some end-users that need to be able to authenticate to a VPN. I am running ACS5.2. How can I setup Authentication on the ACS so that an ASA 5520 will authenticate the users to a VPN, but will not authenticate the administrators.

I logged into the VPN session using an administrator account that is not a member of the user group.

I would think that it would be easy to do this and I am probably overlooking something, but the ASA is setup to use authentication from the ACS and it seems to authenticate any user that is on the ACS.

Thanks in advance,

Alex Pfeil

Two AAA Identity Groups

Jatin Katyal — Thu, 13 Jun 2013 08:56:09 GMT

Hi Alex,

With ACS 5.2, you need to add ASA as a TACACS and RADIUS aaa client.

Create 2 differernt identities groups on ACS. One for Admin and other for VPN users.

Create a authorization rule under default network access with a conditions as

Identity-group: Admin

Protocol as radius

Device: ASA-IP address ( if you don't see this condition, use the customize tab available in the bottom right corner)

Authorization profile: Deny access.

Save

In case you would like to configure same via ASA database (without ACS). here is a blog I created a month ago

https://supportforums.cisco.com/community/netpro/security/aaa/blog/2013/05/05/restrict-local-admin-user-mgmt-purpose-to-access-vpn-on-asa-and-ios

Jatin Katyal
- Do rate helpful posts -

Two AAA Identity Groups

Alex Pfeil — Thu, 13 Jun 2013 11:21:50 GMT

So basically, you have to use authorization as well as authentication instead of just authentication?

Thanks,

Alex

Two AAA Identity Groups

Jatin Katyal — Thu, 13 Jun 2013 12:54:49 GMT

Yes we have to use the autorization rule for determining the access permissions in a network access service.

Jatin Katyal
- Do rate helpful posts -