topic Re: VPN authentication with ACS in Network Access Control

VPN authentication with ACS

andy-gerace — Sun, 10 Mar 2019 22:20:54 GMT

I have a setup where my VPN users hit the ACS server for user authentication - off of AD. What I am not sure of, is how to limit which users have VPN access.

All of the users would still need to authenticate for wireless (EAP) but be limited to either VPN access or No VPN access.

Re: VPN authentication with ACS

Premdeep Banga — Wed, 22 Aug 2007 14:12:42 GMT

Solution would be to make use of CLI/DNIS NAR,

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_white_paper09186a00801a8fd0.shtml

Regards,

Prem

Re: VPN authentication with ACS

andy-gerace — Wed, 22 Aug 2007 15:21:44 GMT

I have tried that and it does not seem to make a difference. If I add the AAA group (the firewall in this case) and add * for the CLI, DNIS, etc. it will still let me log into the VPN client as a user in that group.

Am I supposed to be putting something different in for the port, etc.?

Re: VPN authentication with ACS

wpetherbridge — Wed, 22 Aug 2007 16:23:42 GMT

I have the same problem. I haven't tested it yet but believe it will be in the lines of - create a new GPO in AD for VPN users. On the ACS you can do group mappings to specific AD groups and then limit it that way. But like I say I haven't tested it yet. If you do get it right please post your findings.

Thanks

Will