How to block non-domain users

[majedalanni]

Dears

I have question about how to block a non-domain user that have an IP from the inside network from accessing the internet by The Cisco ASA 5520.

Thanks in advance.

Mike

[Federico Coto Fajardo]

Hi Mike,

The ASA normally will block based on IP address.

So, if you want to block an IP address, it's very easy with an ACL.

If you want to block a user (it's hard to do it on the ASA because the ASA would not authenticate the user when tries to go to the Internet does it)?

For example, there's a feature called Authentication Proxy which the ASA prompts a user/pass to each user when wants to go to the Internet (but you need an external authentication server or database).

If he has a static IP its easy to block it otherwise the ASA should participate in the authentication to be able to block it.

Federico.

[majedalanni]

Hi,

What about per user override feature. Does it help me? I have Radius server same on AD server for my VPN clients.

Mike

[Federico Coto Fajardo]

Per user override will apply the ACL after the authentication result.

The idea is apply the filter to the user after authentication based on the user credentials.

Federico.