SSL VPN - Control access based on AD group

[abimadaro4462]

Hello,

I've a case where the SSL VPN Firewall needs to be integrated with the AD, based on AD the access should be controlled. The only way that comes into my mind is to configure different group policies and different IP pools for different departments, then apply a VPN filter on each group policy to control what that IP pool can access and what not.

Any other suggestions / best practices?

Thanks,

[Rob Ingram · Accepted solution]

@abimadaro4462 

Yes, that'll work fine.

If you used ISE/RADIUS, you could dynamically assign the IP Pool or DHCP scope based on AD group membership, without using multiple group policies. You could also apply a Downloadable ACL (DACL) instead of VPN Filter. Alternatively you could deploy trustsec for segmentation.

HTH