cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
827
Views
0
Helpful
1
Replies
Highlighted
Beginner

Multiple match in Cisco ASA DAP for AD groups

Hello, my goal is to create granular network access, with ACL concatination, based on AD groups to which user belongs.

For example, I want members of Group1 be able to connect only to Server1 (asume ACL1 permits it), and Group2 only to Server2 (ACL2)

It's trivial when I have only users which belong to only *one* of the groups.

I create following DAP:

DAP1: memberOf = Group1 -> apply ACL1

DAP2: memberOf = Group2 -> apply ACL2

The questions is - I can't force Cisco ASA to concatinate both ALC's, if user belongs to *both* groups. It apply only ACL1, trace says:

Selected DAP records

--------------------

DAP1

Although user in *both* groups.

I can't use solution when I create separate DAP3 with both groups defined in it, because two groups was just for example, I'll have about 10 of them.

Thank you for any suggestions!

1 REPLY 1
Highlighted
Beginner

Okay, actually it works as expected, in debug dap trace I see that DAPs get concatinated, 'Test dynamic policy' in ASDM confused me, because it didn't want to apply both my policies, seem bug in it.

Content for Community-Ad