AD groups, wireless/VPN restrictions ACS4.0

[mark.stephens]

Hi,

I have a situation where I have 2 groups in ACS called wireless and VPN. I have successfully mapped these to 2 AD groups called the same.

My requirement now is to restrict the wireless users so that they can only authenticate through an access point and not the vpn.

How would I achieve this bearing in mind I can restrict on IP address as they are all in the same subnet?

Is there anyway to configure say user1 will only be able to connect via the wireless?

[ethiel]

If you go to Interface Configuration->Advanced options, there is an option "Group-Level Network Access Restrictions". If you check that, then under each group you can define what devices members can authenticate on. For your VPN group, only allow them to access your VPN devices, and your wireless only allow them to access your wireless devices.

-Eric

Please remember to rate all helpful posts.

[news2010a]

Great. I am working on the exact same solution you answered my question.