ASA with 2 Remote Access VPN and 2 MS IAS

[mattsmith]

We have a Cisco 5510 with 2 IPSec Connection Profiles each using a different IAS for authentication.

If we add another VPN profile we need another IAS.

With Cisco ACS can it be configured for different VPN profiles from the same ASA 5510?

Thanks...

[Devashree Chakrabarti]

Hello Matt

Yes, you can. You need to configure aaa-server (i.e. ACS server) and add them into different VPN profiles. The sample config will be :

aaa-server vpn protocol radius

aaa-server vpn host x.x.x.x

key

tunnel-group general-attributes

authentication-server-group vpn

tunnel-group general-attributes

authentication-server-group vpn

thanks

Devashree

[andamani]

yup..

on the ACS you just need to add ASA as a AAA client.

on the ASA you can define this ACS server as the authentication server on as many tunnel-groups as you wish too.

Hope this helps.

Regards,

Anisha

P.S.:please mark this post as answered if you feel your query is resolved. Do rate helpful posts.

[mattsmith]

OK... Here is the requirement for VPN.

Each ASA Connection Profile requires a different windows group to authenicate.

So can the ACS be configured to know about the different ASA Connection Profiles.?

Thus assign the correct windows group using external auth?

Thanks

Matt

[Devashree Chakrabarti]

Hello Matt

Here you need to configure.

[1] Configure group mapping of AD-groups with ACS server, in such a way as

AD-1 ----> Group1 [acsgroup]

AD-2 ----> Group2 [acsgroup]

[2] Configure group-lock feature on ACS server i.e enable class attribute.

     - if you have 2 - tunnel-groups on ASA say tunnel1 and tunnel2

     - enable class attribute 21

     - Group1 (on acs server) - class attribute " OU=tunnel1; "

     - Group2 (on acs server) - class attribute " OU=tunnel2; "

How will it work ?

     - When user-A, who is a menberof AD-1, it will only connect to "tunnel1" as ACS has binded the AD-group with tunnel-group. This feature is known a Group-lock.

Check this doc :

     - https://supportforums.cisco.com/docs/DOC-1746

Let me know if it helps.

thanks

Devashree