topic Re: Configure VPN profile to use Active Directory Security Group for authorisation on ASA firewall in Network Security

Is this possible ? Multi-factor authentication through a combination of RSA token and Active Directory user account and authorisation using LDAP Security Group member check for remote access VPN in ASA firewalls

damode — Fri, 21 Feb 2020 16:18:31 GMT

I am currently working on a POC to achieve Authentication and Authorisation for remote access VPN on ASA firewalls whereby RSA server and AD user account is used for authentication, and the LDAP - Security Group (SG) member check is used for authorisation.

Can someone please advise if the above solution is possible to achieve ? If yes, please direct to the right documentation for this.

Thanks in advance.

Re: Configure VPN profile to use Active Directory Security Group for authorisation on ASA firewall

Mohammed al Baqari — Wed, 17 Oct 2018 06:17:00 GMT

You need to use DAPs to apply security rules such as ACLs based on memberOf
attribute. This is after successful authentication against LDAP/RSA which
you can do by configuring LDAP aaa-server

Re: Configure VPN profile to use Active Directory Security Group for authorisation on ASA firewall

damode — Wed, 17 Oct 2018 22:40:09 GMT

Hi Mohammed,

Thanks for your response. My only main concern is whether the information retrieved about the user once RSA authenticates, would be able to accurately mapped to what LDAP can accept in order to provide authorisation for that user ?