Groups in WebVPN

[admin_2]

Hello,

I have configured Web-VPN on my Cisco 3000 Concentrator, it works fine. Now I would like to configure users in different groups, so that one user is allowed to use certain applications, and other users are allowed to use other services. Now, all users authenticate remotely (RADIUS) and seem to land in the base group.

Any good ideas ?

[engel · Accepted solution]

I think , after the user authenticated, return back the group for that user using Class attribute (25) from RADIUS. Let me know if it is worked.

[#3]

Hallo,

thanx, it worked! On my Cisco ACS, I configured two users with class attribute(25) OU=vpngroup1; and OU= vpngroup2;. On the Concentrator, I configured the two groups with different allowed applications. After login, the users can only connect to the allowed applications.

great!

[bma]

Hi

Do you get to fix? I have same problem. From Cisco doc, can setup attribute OU=group_name assign to user to a particular group, but I try it in the Cisco ACS and not working.

Thanks

ben

[#5]

hello,

see the answer above. How did you configure the concentrator ? What are the settings for the group ?

[bma]

Hi

I setup a ssl_vpn group in the 3015 and enable webvpn and setup www and port forward for the webvpn,

but from webvpn login only get base group permit.

I am using Cisco ACS 2.64, and I try attribute 11 and attribute 25 for one user, but it's not work.

Do you use IETF or Cisco VPN 3000 for the RADIUS for the Concentrator 3000 (in the ACS NAS Authenticate using)? is class 25 only IETF? I am using RADIUS with Cisco VPN 3000 now, maybe I need to change to IETF.

Thanks

ben

[gfullage]

Return Radius (IETF) attribute 25 (Class), and make sure it is in the form:

OU=;

OU is in capitals, and make sure you include the semi-colon at the end, your original post didn't show that you had that.

See http://www.cisco.com/en/US/tech/tk583/tk547/technologies_configuration_example09186a00800946a2.shtml for the format, this sample config is not for WebVPN specifically but the concept of locking a user into a group is the same.