topic Re: using LDAP group to autenticate users from inside network to in Network Access Control

using LDAP group to autenticate users from inside network to Internet

luisborges — Sun, 10 Mar 2019 22:48:39 GMT

Hi team, I got an asa 5510 version 7.2.3 and i need to autenticate my users from inside network to internet using a security group in the Active Directory, anyone can help me with these?

Re: using LDAP group to autenticate users from inside network to

smahbub — Wed, 30 Apr 2008 18:56:49 GMT

To configure the security appliance for LDAP(Lightweight Directory Access Protocol) authentication and authorization, you must first create an LDAP attribute map which maps customer-defined attribute names to Cisco LDAP attribute names. This prevents you from having to rename your existing attributes using the Cisco names that the security appliance understands.

for more information on configuring LDAP refer:

http://www.cisco.com/en/US/docs/security/asa/asa71/asdm51/selected_procedures/asdmldap.html

Re: using LDAP group to autenticate users from inside network to

luisborges — Wed, 30 Apr 2008 22:23:26 GMT

The case that you sent me is for VPN USERS authentication and autorization, and my issue is using the LDAP Server to authentication and autorization for INSIDE NETWORKS USERS, using for example de attributes of the my AD like memberOf that can be understood by the security appliances.

Re: using LDAP group to autenticate users from inside network to

yussetamayo — Fri, 27 Jun 2008 14:53:15 GMT

Rigth luis, i have the same issue, i want authenticate groups in AD to give them some authorizations, like URL filtering,, i am trying with the csc module,

Can i?

Re: using LDAP group to autenticate users from inside network to

luisborges — Sat, 28 Jun 2008 04:33:59 GMT

I'm not sure, the recommendations than cisco team TAC sent me was buy a ACS server license to solve my issue, about URL filtering i'm thinking about websense solutions it cost 19$ per user and works very well on CISCO ASA.

cheers !

Re: using LDAP group to autenticate users from inside network to

yussetamayo — Sat, 28 Jun 2008 12:44:28 GMT

thanks luis.

web sense is for block my lan users using LDAP profile???

DO you know if i can use the csc ssm module??

Re: using LDAP group to autenticate users from inside network to

GRAEME DANIELSON — Sun, 29 Jun 2008 12:34:58 GMT

This might not be complete for your needs but it may give you enough of what you need without having to purchase full url filtering etc.

Authenticate with LDAP as shown earlier in this thread, then use this aaa ldap with cut-through proxy -

PIX/ASA : Cut-through Proxy for Network Access using TACACS+ and RADIUS Server Configuration Example

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00807349e7.shtml

then do some filtering -

ASA/PIX 8.x: Block Certain Websites (URLs) Using Regular Expressions With MPF Configuration Example

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080940e04.shtml