WebVPN groups and RSA SecureID configuration...

[ahmed.gadi]

Greetings All,

I have a ASA 5520 upon which I need to build a WebVPN for the company urls - webmail, intranet portals etc.

There will be 2 groups -

a. Confidential Access - For senior management.

b. Public Access - For employee access.

RSA Token & LDAP auth would be used for access to the WebVPN.

How do I isolate the 2 groups?  I mean only Senior management should be able to view & access the first set of links while employees see and access the other set of links only.

Both the groups will be available to all users loggin on to the WebVPN. Since the authentication mechanism - LDAP - is the same, anyone would be able to access the groups and in turn, urls.

Please suggest what approach can be taken in this regard.

Thanks,

Ahmed Gadi

[Herbert Baerten]

Hi Ahmed,

you can achieve this by creating groups (if you don't already have them) on the LDAP server, then putting the users in the appropriate groups.

Then on the ASA you can do one of two things:

- use DAP policies to apply settings based on the LDAP memberOf attribute

or

- use an LDAP attribute map to map the memberOf attribute to a group-policy

Let me know if you would like more details on either option.

hth

Herbert