topic Re: Assign VPN Group Policy via Radius and Microsoft NPS server in Network Access Control

Assign VPN Group Policy via Radius and Microsoft NPS server

branfarm1 — Sun, 10 Mar 2019 23:34:14 GMT

Hi there,

I'm using Microsoft Network Policy server (formerly known as IAS server) for Radius Authentication. Is there a way to configure NPS so it will assign a VPN Group Policy on the ASA? Basically, I'd like to create multiple VPN group policies for different types of users and assign them via AD groups so when the user logs in to the VPN they get the Policy designed for them.

Thanks in advance,

--Brandon

Re: Assign VPN Group Policy via Radius and Microsoft NPS server

andrew.prince — Tue, 30 Jun 2009 08:00:14 GMT

See the below config example:-

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00808d1a7c.shtml

HTH>

Re: Assign VPN Group Policy via Radius and Microsoft NPS server

Peter Noble — Thu, 15 Jul 2010 02:58:51 GMT

Yes, this works just fine with Microsoft NPS. In a nutshell, you tell NPS to return the radius attribute 25 (It's called "Class") and assign it the value of ou=MyVPNGroupPolicy where MyVPNGroupPolicy is the name of your group policy in the ASA.

I want to say this option is under the standard radius attributes on one of the last configuration screens of the wizard. You do NOT need to configure this using an LDAP setup, you can continue to use NPS, just like you did IAS.

Re: Assign VPN Group Policy via Radius and Microsoft NPS server

yvesneptune — Thu, 16 Jul 2020 12:19:41 GMT

I did like you said with multiple group policy name in an ASA 5512. But my problem is that any user from AD can log in any group even if they are not in the group in AD. Please help