SSL VPN groups with RSA

[pweinstein]

I have a Cisco ASA5510 running 8.2.2.  I am tasked with needing to have users authenicate with RSA tokens.  Easy enough to setup once we got the RSA server and tokens.  Now I am faced with the problem of controlling which VPN groups users are authorized to login to (i.e. end users, sysadmins, msadmins, netadmins, etc).  Currently any user can login to any group.  We need to lock down what VPN groups users are permitted to login to, so that we don't have a end user suddenly having access to our HR servers or any of our production systems.

The method we used before we implemented RSA tokens was with LDAP.  However RSA says they don't support LDAP/group authorization.  Has anyone else run into this and what are some possible solutions.

Thanks,

Paul W

[Marcin Latosiewicz]

Paul,

If you don't know which group a given user belongs to it will be tricky/impossible.

You can use group-lock in ASA, but you would need to know the group.

I've seen RSA servers connecting to ASA both via SDI or RADIUS, which one do you use and how many users are we talking about?

If RADIUS you can push other parameters from server - like group.

Marcin