understading athenticationa nd authorization in FMC remote access vpn

[baselzind]

just to be clear with the authentication and authorization in FMC RAVPN , if i set radius for authentication and AD for authorization would that mean that users will be first authenticated using radius database then the authorization will check i these users exist in AD or not and based on that they will be able to connect? like user"John" have to be on both

radius and AD to be able to connect to RAVPN?

[Rob Ingram]

Hi,
You wouldn't set AD to authorise the user, only RADIUS can do authorisation. If your RADIUS server is integrated into AD you would normally set Authentication, Authorisation and Accounting to be the RADIUS server. It would then proxy the authentication request to AD.

HTH

[baselzind]

why not? can someone explain please the difference between authentication and authorisation?

[Rob Ingram]

Authorization is used to determine what a user can and cannot do, authentication identifies the user prior to be allowed access to the network. AD doesn't allow you to create the required authorisation rules, a RADIUS server does.

[Cristian Matei]

Hi,

      For VPN, authentication means the user provides some sort of credentials to the VPN gateway in order to establish the VPN tunnel. For VPN, authorization means, once the VPN tunnel has been established, how is the user allowed to build the tunnel (using SSL or IPsec, timeouts, etc) and what is the user allowed to do in the tunnel (split-tunnelling policy, VPN filter, etc). Because RADIUS, by design, does authentication and authorization in one process, you can't do authentication via RADIUS and authorization via AD/LDAP or vice-versa. But you can do both authentication and authorization via either RADIUS or AD/LDAP (you would need to use FlexConfig for this); you can get complex, but for no real reason/benefit in general, and do both via RADIUS, but then have the RADIUS server integrated with LDAP/AD.

Regards,

Cristian Matei.