Hi,
We currently have an ASA 8.2.5 that authenticates remote access VPN users who connect using AnyConnect 3.1 via Radius which is running on Microsoft IAS. We have 6 or 7 groups in Active Directory and as long as they are in the correct group they get the correct tunnel-group and group policy which gives them the correct ACL. We would like to move this authentication to ACS 5.2 which we have running already for tacacs authentication to network equipment.
I have added a new AAA Server group for the ACS server which tests fine from the ASA and also have joined the ACS to our AD domain. I have set up a tunnel-group and group policy and changed User Authentication to the ACS server group. The issue is that I get the following error message when trying to authenticate with the user:
Group <DfltGrpPolicy> User <testuser> IP <xx.xx.xx.xx> Authentication: rejected, Session Type: WebVPN
AAA user authentication Rejected : reason = AAA failure : server = xx.xx.xx.xx : user = testuser
It looks to me like it is defaulting to the DefaultWebVPNGroup tunnel group which has our IAS server configured as the Authentication Server Group.
I did use the AnyConnect VPN wizard and it created the tunnel-group, group policy and AnyConnect Client Profile which did authenticate the user but it added the tunnel-list drop down in AnyConnect. We do not want the drop-down in AnyConnect and want the user to just enter their AD network credentials and be assiged the correct tunnel-group/group policy and be authenticated to ACS.
I cannot change the Authentication Server Group for the Default WebVPNGroup to our ACS as we want to migrate groups from the IAS to the ACS.
Do I have any other options to allow both IAS and ACS authenticate users with out the use of the tunnel-list in AnyConnect?
Thanks in advance.
Jeff
