topic Client Authentication VPN3000 in Network Access Control https://community.cisco.com/t5/network-access-control/client-authentication-vpn3000/m-p/280383#M6003 <P>I have a VPN concentrator that is configured for client authentication using an NT domain. I dont want every account in Active Directory to have VPN access, so i was wondering if it was possible to limit the scope of where the vpn 3000 looks for accounts to authenticate. Can it be limited to a particular organiztional Unit in Active Directory? </P> Fri, 21 Feb 2020 18:09:44 GMT henrysacco 2020-02-21T18:09:44Z Client Authentication VPN3000 https://community.cisco.com/t5/network-access-control/client-authentication-vpn3000/m-p/280383#M6003 <P>I have a VPN concentrator that is configured for client authentication using an NT domain. I dont want every account in Active Directory to have VPN access, so i was wondering if it was possible to limit the scope of where the vpn 3000 looks for accounts to authenticate. Can it be limited to a particular organiztional Unit in Active Directory? </P> Fri, 21 Feb 2020 18:09:44 GMT https://community.cisco.com/t5/network-access-control/client-authentication-vpn3000/m-p/280383#M6003 henrysacco 2020-02-21T18:09:44Z Re: Client Authentication VPN3000 https://community.cisco.com/t5/network-access-control/client-authentication-vpn3000/m-p/280384#M6005 <HTML><HEAD></HEAD><BODY><P>You may have to use ACS. It can check the windows groups and dial-in settings. then replay to the VPN server correctly. </P></BODY></HTML> Thu, 18 Mar 2004 01:38:25 GMT https://community.cisco.com/t5/network-access-control/client-authentication-vpn3000/m-p/280384#M6005 kerry.whittaker 2004-03-18T01:38:25Z Re: Client Authentication VPN3000 https://community.cisco.com/t5/network-access-control/client-authentication-vpn3000/m-p/280385#M6006 <HTML><HEAD></HEAD><BODY><P>You would have to use Radius. Microsoft's built in IAS would do the trick. It can allow you to specify a group that can access the VPN. I'm not sure if it can match on an OU though... Maybe. You might also have to be in Native mode for some of that to work.</P></BODY></HTML> Mon, 05 Apr 2004 15:05:33 GMT https://community.cisco.com/t5/network-access-control/client-authentication-vpn3000/m-p/280385#M6006 jjkruege 2004-04-05T15:05:33Z