05-01-2009 10:24 AM - edited 03-10-2019 04:28 PM
Just like the title says....
We use TACACS for admin authentication to our ASAs. I now want to use the webauth capability of the ASA to force a "captive portal" authentication against tacacs to get to various resources.
So I configured the webauth thing on the ASA and I can authenticate no problem....but I am not sure how to add people to TACACS that I want to be able to access the website via webauth but I do not want to be able to authenticate to the firewall.
Also how would I have the ASA authenticate groupA users to get to websiteA and authenticate groupBusers to get to websiteB while not having any of the groupB users get to websiteA and vice versa?
thanks!
05-01-2009 11:22 AM
For your 1st issue you can use NAR's feature. In this you need to use IP based network access restriction. Here you deny access to ASA.
Now these users will not able to telnet, ssh or https to firewall but will be able to authenticate to portal.
http://cisco.com/en/US/products/sw/secursw/ps2086/products_tech_note09186a0080858d3c.shtml
For 2nd issue you can try Downloadable ACL.
http://cisco.com/en/US/products/ps6120/products_configuration_example09186a0080a9eddc.shtml
Regards,
~JG
Do rate helpful posts
05-04-2009 11:02 AM
"For your 1st issue you can use NAR's feature. In this you need to use IP based network access restriction. Here you deny access to ASA.
Now these users will not able to telnet, ssh or https to firewall but will be able to authenticate to portal. "
Won't they still be able to ssh to switches and things if I do this? If I am creating a Deny rule wouldnt I have to create one for every device I want them to not connect to? For example all of our switches and routers?
Is there a way to provide this access using a single permit rule? Denying every device individually does not scale well and I just tried a NAR to deny access from all devices on all ports and that didnt work...I was unable to authenticate then.
05-04-2009 04:20 PM
You can use permit option instead of deny. You can create one fake or null device in acs network configuration and give permit access in NAR for that fake device.
Now user can only access that device listed in NAR and rest everything would be denied, just like ACL.
Use * for port number and ip address.
Regards,
~JG
Do rate helpful posts
05-05-2009 04:03 AM
I just tried this but I cannot authenticate via webauth with this configuration....
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide