Security for one specific user

thomas.green — Tue, 12 Mar 2019 00:49:25 GMT

Hello,

We have an ASA 5510 version 8.3 (2) that we accept VPN users via a radius server. Is there a way to lock down a specific user that connects to the ASA as a SSL client or IPSEC VPN user? If the specific user were to connect to the ASA, we would want the user to have minimal to not access to our system. Any help would be greatly appreciated.

Thanks

Re: Security for one specific user

Michal Garcarz — Sun, 20 Jan 2013 07:05:42 GMT

Hi Thomas,

Yes, there are many options.

Basically ASA accept radius attributes returned for user (during user authentication)

You can return attribute:

IPsec-Split-Tunnel-List with the name of ACL on ASA which will be applied for that user (decides which traffic goes thru the tunnel, which not)

You can also use Radius IETF 25 Class attribute and set it to specific group policy name.

In that group policy on ASA you might want to have for example:

simultaneuous logins = 0

http://www.cisco.com/en/US/docs/security/asa/asa84/command/reference/uz.html#wp1664777

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/ref_extserver.html

---

Michal

topic Security for one specific user in Network Security

Security for one specific user

Re: Security for one specific user