ASA RADIUS auth request with tunnel-group attribute

[jkloet]

ASA version 8.4(5), AnyConnect clients, Cisco ACS 4.2

I need to pass on (inbound RADIUS attribute) to ACS what tunnel-group is being used to establish a VPN session.  I don't see this as an option anywhere ... does anyone know if this is possible?

Thanks, Jeff K

[jan.nielsen]

I believe that should be enabled by default on the ASA, however i don' remember what version this was introduced in, but it was quite recent, so maybe your 8.4.5 doesnt send the tunnel-group name in the radius request.

[jkloet]

Thanks for that info Jan.  I will try a newer version and report back what I find.  Jeff K

[jkloet]

I discovered the "Tunnel Group Name" attribute was added in ASA 8.4.3 ... see release notes.

It turns out our actual problem is that ACS Windows 4.x does not recognize this new attribute.

I opened a TAC case and hooked up with a great support engineer.  She found a patch (put together a while back for another customer) to update an ACS 4.x databse so it will recognizes the Tunnel Group Name attribute.

Thanks Eli!

Jeff K