Hello, I have configured remote access vpn on asa with ldap authentication. But I can't limit vpn access with specific ldap group.
Here is my config:
ldap attribute-map VPN_GP_MAP
map-name memberOf Group-Policy
map-value memberOf "CN=Alternate VPN HR Users,OU=Groups,DC=internal,DC=company,DC=com" HRVPN
map-value memberOf "CN=Alternate VPN Users,OU=Groups,DC=internal,DC=company,DC=com" VPNUsers
aaa-server VPN_LDAP protocol ldap
aaa-server VPN_LDAP (INSIDE) host 192.168.1.1
ldap-base-dn dc=internal,dc=company,dc=com
ldap-scope subtree
ldap-naming-attribute sAMAccountName
ldap-login-password *****
ldap-login-dn ldap_vpn@internal.company.com
server-type microsoft
ldap-attribute-map VPN_GP_MAP
group-policy NOACCESS internal
group-policy NOACCESS attributes
vpn-simultaneous-logins 0
vpn-tunnel-protocol ikev2 ssl-client
address-pools none
group-policy VPNUsers internal
group-policy VPNUsers attributes
wins-server none
dns-server value 192.168.1.1
vpn-idle-timeout 30
vpn-session-timeout 480
vpn-tunnel-protocol ikev2 ssl-client
group-lock value LDAP_VPN_GROUP
split-tunnel-policy tunnelall
split-tunnel-network-list value Split_Tunnel_List
default-domain value company.com
split-dns value internal.company.com
split-tunnel-all-dns enable
client-bypass-protocol enable
address-pools value VPNPool
webvpn
anyconnect modules value vpngina
anyconnect profiles value VPNprofile type user
group-policy HRVPN internal
group-policy HRVPN attributes
wins-server none
dns-server value 192.168.1.1
vpn-idle-timeout 30
vpn-session-timeout 480
vpn-tunnel-protocol ikev2 l2tp-ipsec ssl-client
split-tunnel-policy tunnelall
default-domain value internal.company.com
split-tunnel-network-list value Split_Tunnel_List
split-dns value internal.company.com
split-tunnel-all-dns enable
client-bypass-protocol enable
address-pools value HRVPNPool
webvpn
anyconnect modules value vpngina
anyconnect profiles value VPNprofile type user
tunnel-group LDAP_VPN_GROUP type remote-access
tunnel-group LDAP_VPN_GROUP general-attributes
address-pool VPNPool
address-pool HRVPNPool
authentication-server-group VPN_LDAP
default-group-policy NOACCESS
tunnel-group LDAP_VPN_GROUP webvpn-attributes
group-alias "(3) - Alternate" enable
The problem is, no domain users can connect to vpn. If I change the default group policy for the tunnel-group to one of the group policies configured in the attribute-map then all users have access to the vpn. ASA does not filter group assignment, non "Alternate VPN User"(and non "Alternate VPN HR Users") group users can connect, but they should not be able to connect. I'm starting to think my ldap attribute-map needs to be changed. I've seen other examples where they use other map-names and map-values. I've had this working in the past but now it does not work as intended. I'm definitely missing something.
ASA version 9.9.2
