VPN Authenntication - AD VPN Users Group membership- Kerberos Protocol

[Chts]

Hi All,

Can ASA(9.8) supports AD VPN users Group membership ( ex. Exernal_VPN_Users ) for authentication using Kerberos protocol? if so any configuration example would be greatly appreciated.

Many Thanks.

[Mohammed al Baqari]

ASA support Kerberos authentication. See this link.

https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/68881-aa-svrgrps-asdm.html

For AD Group authorization, you need to use DAP.

[Chts]

Thank you Mohammed.
We are using Win10 built-in VPN client which is presenting User certificate to ASA for authentication, should I use ikev2 remote-authentication eap query-identity or ikev2 remote-authentication certificate ?

Ref:
tunnel-group DefaultRAGroup ipsec-attributes
ikev2 remote-authentication eap query-identity
ikev2 local-authentication certificate VPN_Certificate

[Mohammed al Baqari]

I haven't tried windows client for VPN. But since you are using cert auth,
then it should be remote-authentication certificate