Anyconnect VPN: how to block LDAP user in ASA

[hashimwajid1]

Hi

we integrated LDAP with ASA to authenticate Anyconnect users, we do not want all users in AD group to be authenticate. 

is there any way to restrict  or block  user in AD Group or ASA ?

ASA version 9.6

Thanks 

[Mohammed al Baqari · Accepted solution]

Great a group in AD called blocked users, assign it to users which
shouldn't access the network over anyconnect, create dap rule with deny any
any acl to block users which are member of this group. Another way is to
use ldap attribute-map to match users within this group and assign a group
policy which blocks them

[hashimwajid1]

Hi Mohammad,

in AD there is already a User Group ( OU ) all users are in this OU. we want some users of this OU to not to use Anyconnect. 

we dont want to create separate Group. is there any  way to block user within same OU

[Mohammed al Baqari]

AD groups are different from OUs. They can be in same OU but members of
different groups.

If you assign groups to users and follow my scenario it should work.

[hashimwajid1]

Hi Mohammed,

i am able to block Users by using DAC.

thanks for your suggestion 

one query 

i have two VPN Group Profile in ASA with different privileges.  whenever user try to connect with Anyconnect Client, user has to select between these two login profile.

is there any way that user should not select these login profile and just enter his credential ? and after that it will automatically map to desire VPN Group in ASA ?

Thanks

[Mohammed al Baqari]

create one default group-policy assigned to your tunnel-group. Then create
ldap-attribute map since you are authenticating with AD. Now, map memberof
attribute to group-policy in ldap-attribute map. For example DomainAdmins
maps to GroupPolicy01 and DomainUsers maps to GroupPolicy02. Both group
policies should be pre-created in ASA. You tunnel group should point to AD
for authentication which I believe already the case.

Once AD authentication is successful, new group-policy will be selected
based on memberOf and will override default-group policy. This way users
aren't required to select tunnel-group from drop down. Instead they will be
assigned attributes automatically based on their groups.