Configure a Network Policy for VLANs on ASA

[ABaker94985]

We have a pair of ASA-5545X's running 9.14.2 that we'd like to try to configure Windows NPS for users to be placed into VLANs when they VPN into our firewall. Reference https://docs.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-np-configure and the section on "Configure a Network Policy for VLANs". On the Windows NPS server, Tunnel-Pvt-Group-ID is configured which assigns users in a group to a particular VLAN. Will the ASA understand the attribute and put the user into the correct VLAN? Users do login using SAML for SSO and MFA to Azure, and ISE is not currently available.

I should mention I see the VLAN keyword under group-policy, but I don't think this is quite what I need. We have several hundred VPN users, and I don't see a way to lock a user group to a VLAN using this procedure. Thanks

[Milos_Jovanovic · Accepted solution]

Hi @ABaker94985,

You can't use VLAN attribute on ASA. This approach is meant for 802.1x on WiFi or Wired. On ASA, you can assign different IP pool, which provides you with similar approach.

For assigning IP pool, chech this thread. There you can see required attribute.

If you are using ASA-Azure integration with SAML, you'll need to add authorize-only server, in order to get this configuration from RADIUS server. You can find some explanation here. I also managed to find this explanation for Microsoft NPS.

This way, you'll get your authentication from SSO, and once authenticated, you'll proceed to authorization, where you can assign your attributes from AAA server.

BR,

Milos