topic Re: WEBVPN Authentication in Network Access Control

WEBVPN Authentication

Peter Valdes — Fri, 21 Feb 2020 18:21:55 GMT

Hi,

We have setup SSLVPN on a Cisco 3800 to host VPN for IP Communicator (VOIP). IOS = IOS AdvanceSecurity 12.4-15(T) and Cisco Secure ACS v3.0

We have trialed an authentication method by using our existing TACACS+ server to host the AAA for the SSLVPN but the problem is the same user account can login to our routers using the same TACACS+.

Is there a way to permit SSLVPN auth for VOIP use and deny access to our routers using the same AAA server?

Re: WEBVPN Authentication

Marwan ALshawi — Thu, 21 Aug 2008 10:34:21 GMT

if u are giveing users a pool of IPs through the ssl vpn u can u se an ACL on the outside interface that allow only access to the voip network and deny anything els!

Re: WEBVPN Authentication

Peter Valdes — Thu, 21 Aug 2008 22:14:47 GMT

Hi, Thanks for the reply.

The part has been secured. The problem is when they are not using the VPN. Normal ADSL connection and if they know the public IP Address of one router, they can VTY/SSH to it using their TACACS+ account.

VTY has ACL already to only allow our internal network in. SSH is for outside use.

I should have included this on the first message to be more clearer.

Is there a setup on the TACACS+ to deny VTY/SSH use of the accounts?

Thanks

Re: WEBVPN Authentication

Marwan ALshawi — Fri, 22 Aug 2008 03:27:49 GMT

in this case you need to use AUth proxy if ur router include IOS firewall feature

this way u can spisify whay ports are allowed and use source and distination IPs.

Re: WEBVPN Authentication

Premdeep Banga — Fri, 22 Aug 2008 11:40:32 GMT

As your Tacacs+ is ACS, then you can make use of NAR (Network Access Restriction).

Users will be prompted for username/password if device is configured for the same, but they wont be able to telnet/ssh into the Network Device. But should be able to do VPN.

Please go through what attributes are evaluated for a NAR to be applied,

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_white_paper09186a00801a8fd0.shtml

Regards,

Prem

Please rate if it helps!

Re: WEBVPN Authentication

Peter Valdes — Fri, 22 Aug 2008 13:02:27 GMT

Thanks. I will try this and let you know on the result.

Thanks again for your replies.

Peter

Re: WEBVPN Authentication

Peter Valdes — Mon, 25 Aug 2008 02:44:11 GMT

Hi,

Thanks for all your help. NAR works.

Cheers

Peter

Re: WEBVPN Authentication

Marwan ALshawi — Mon, 25 Aug 2008 02:47:21 GMT

Prem this is 5+ from me 🙂