topic Re: ASA static ip address per user in Network Security

ASA static ip address per user

patel.nishit — Fri, 21 Feb 2020 11:02:17 GMT

Need to know if their is a way to configure the following on the ASA.

We have 60 users login via VPN through ASA and authenticated via Radius server.

So we need, 60 users configured with each allocated a static ip address.

For example;

60 User - 60 Static Ip address

User 1 - 10.10.10.1

User 2 - 10.10.10.2

User 60 - 10.10.10.60

At present we can do this by creating a object-group per user but this is not scalable, therefore if their is a efficient way of doing this.

Re: ASA static ip address per user

sadbulali — Fri, 10 Oct 2008 19:03:39 GMT

To use DHCP to assign addresses for VPN clients, you must first configure a DHCP server and the range of IP addresses that the DHCP server can use. Then you define the DHCP server on a tunnel group basis. Optionally, you can also define a DHCP network scope in the group policy associated with the tunnel group or username. This is either an IP network number or IP Address that identifies to the DHCP server which pool of IP addresses to use.

Refer the url below for more information on configuring ip address in ASA:

http://www.cisco.com/en/US/docs/security/asa/asa81/config/guide/vpnadd.html#wp998941

Re: ASA static ip address per user

Farrukh Haroon — Sat, 11 Oct 2008 10:43:37 GMT

You can assign each user an IP address via the following:

> Locally for each user. (very hectic)

> Using AAA Server

> Using DHCP

Just make sure you set the appropriate option in the 'vpn-addr-assign' command.

Regards

Farrukh

Re: ASA static ip address per user

Alan Huseyin Kayahan — Sun, 19 Oct 2008 13:23:47 GMT

Hello Nishit,

I encountered this in past and best solution is installing IAS (Windows Radius) to a Domain Controller (If you want to grab user information from Active Driectory), or to a standalone computer to grab user information locally from computer. In user's dial-in tab, activate static IP and assign the Ip address to user. Set the authentication-server-group in related tunnel-group in firewall

Regards

Re: ASA static ip address per user

patel.nishit — Mon, 20 Oct 2008 10:34:42 GMT

Is this IAS free to download or do we have to purchase it. Can it be configured on the existing Radius serve.

Re: ASA static ip address per user

Alan Huseyin Kayahan — Mon, 20 Oct 2008 11:30:18 GMT

It is free, built-in to windows 2003 server. I dont know what do you have currently as a Radius service, but win2003's RADIUS is called IAS. (Internet Authentication Server) Here is how to install

http://technet.microsoft.com/en-us/library/cc781690.aspx

here is the configuration

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806de37e.shtml

Feel free to ask during implemention

Re: ASA static ip address per user

jer0nim0x — Sat, 02 Oct 2021 13:21:04 GMT

I don't see how using DHCP alone can assign a static IP to the user.

DHCP has no notion of users. At best your get the hostname in the DHCP request. You don't even have the MAC address of the remote device in a VPN scenario.