ASA LDAP Authentication for SSL VPN

[angel-moon]

Hello everyone,

I am having a problem getting an ASA running 8.3 to authenticate an SSL VPN directly against an LDAP on Windows Server 2003.  I have changed the read access on the Active Directory to allow Annonymous to read it.  I think I am missing something on the ASA config.  I have the Server Group specified with the address of the correct server but nothing else really configured.  Any help is appreciated.  I am attatching a screen shot of where I think I might be missing some information

All replies rated.  Thanks in advance!

[Roman Rodichev]

You need to specify base DN. For Login DN just create a regular user account, something like ciscoldap. Here's the cli config:

aaa-server AD protocol ldap

aaa-server AD (inside) host WINDOWS_DC_SERVER

server-port 3268 (or 389)

ldap-base-dn DC=domain,DC=com

ldap-scope subtree

ldap-naming-attribute sAMAccountName

ldap-login-password

ldap-login-dn CN=ciscoasa,CN=Users,DC=domain,DC=com

server-type microsoft

!

tunnel-group GROUP type remote-access

tunnel-group GROUP general-attributes

authentication-server-group AD