multiple remote vpn groups, multiple active directory groups

dylan.ebner — Sun, 10 Mar 2019 23:17:08 GMT

We are running PIX 7.2 on a PIX 525. Is is possible to somehow make sure users can only log into one vpn group based on their AD security group. We are currently using IAS to authenticate users but any user that has VPN rights in the AD can log into any remote VPN group on the firewall.

Basically I want to define several security groups in the AD and only users in security group "manager" can use the remote tunnel group "manger", etc.

Is this possible?

Re: multiple remote vpn groups, multiple active directory groups

vmoopeung — Thu, 22 Jan 2009 16:01:08 GMT

I think it is possible.In the example given in the below URL, users who are allowed â€œdial-inâ€ access in the AD/LDAP server are mapped to the â€œALLOWACCESSâ€ group policy, and the users who are not allowed â€œdial-inâ€ access are assigned to the â€œNOACCESSâ€ group policy on the ASA. The â€œNOACCESSâ€ group policy has the number of allowed VPN sessions set to 0, which causes the user connection to fail.You may refer this example configuration for your network.

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008089149d.shtml

Hope this helps.

Re: multiple remote vpn groups, multiple active directory groups

Jagdeep Gambhir — Thu, 22 Jan 2009 17:12:24 GMT

This is how it works.

Lets say that you have three different groups on AD for NetworkAdmin, RouterAdmin,

Wireless.

Go to external user database ==Database Group Mappings==Windows NT/2000==select the domain

to which you are authenticating==Add mapping.

Select the AD group NetworkAdmin and map it to ciscosecure group 1 select the AD group RouterAdmin and map it to ciscosecure group 2

select the AD group Wireless and map it to ciscosecure group 3

Group mappings work in the order in which they are defined, first configured mapping is

looked upon first then second, third and so on. If a user is in AD group NetworkAdmin and

that is mapped to ACS group 1 and it is first configured mapping it will be looked for

FIRST (If a user exists in NetworkAdmin group it will always be mapped to ciscosecure

group 1 and NO further Mappings for this user is checked and user is authenticated or

rejected)

Scenario: if you have a user called cisco, in NetworkAdmin group, cisco1 in RouterAdmin

group, and cisco2 in Wireless. They will always be dynamically mapped to ACS group 1, 2

and 3 respectively as per above mappings.

You can check the mappings on the passed authentications for users as to what group are

they getting mapped to.

SCENARIO:

Now if you want a NetworkAdmin user to authenticate to NetworkAdmin devices and not

wireless or RouterAdmin devices you would need to apply NARs to group 1 because

NetworkAdmin users are connecting to that group. Which you will permit Access on group

basis to a particular NetworkAdmin NDG or individual NetworkAdmin NAS device.

NOTE:

If you are applying NARs for Wireless or VPN devices.. you would need to configure both IP

based AND CLI/DNIS based together because NARs were originally designed for cisco IOS for

routers and switches.

IMPORTANT: If a user successfully authenticates to AD database once, its username is cached on the ACS database (NOT password) the only way to remove the previously cached username is to go to usersetup find that user and delete it manually.

ACS will not support the following configuration:

*An active directory user that is a member of 3 AD groups (group A, B and C) *Those 3

groups are mapped within ACS as follows Group1->A,Group2->B and Group3->C.

*The user is in all 3 groups however he will always be authenticated by group 1 because

that is the first group he appears in, even if there is a NAR configured assigning

specific AAA clients to the group.

However there if your mappings are in below order...

NT Groups ACS groups

A,B,C =============> Group 1

A =============> Group 2

B =============> Group 3

C =============> Group 4.

You can create a DIFFERENT rule for the users in A,B,C by configuring the NARs in group1.

This rule WILL apply for the use ONLY if he is present in ALL three groups (A,B and C).

You can create a rule for users in group A (Group 2)

You can create a rule for users in group B (Group 3)

You can create a rule for users in group C (Group 4)

Here I also enclose the links connected to group mapping in the user guide:

Group mapping order:

http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs33/user/qg.htm

#wp940485

Regards,

~JG

Do rate helpful posts

topic multiple remote vpn groups, multiple active directory groups in Network Access Control

multiple remote vpn groups, multiple active directory groups

Re: multiple remote vpn groups, multiple active directory groups

Re: multiple remote vpn groups, multiple active directory groups