Second Realm creation in SMA/WSA for a separate AD forest authentication

[KEYURPATEL4854]

Hi,

We wanted to configure the second realm in our proxy to authenticate users from a different domain(separate AD forest). Can you please provide the necessary information and help to configure the same?

Keyur 

[sadik.sener1]

Hi Keyur,

Are you asking about how to create second realm or how to make use of it?

The tricky part is making use of it.

In your identification profile, you should make use of the more specific realm, for specific networks. 

You need to define specific networks authenticated by the realm. And the rest will be authenticated by the second realm. 

So , you first need your scope of which subnet should be authenticated against which realm.

Hope that helps.

Kind regards

Sadik

[KEYURPATEL4854]

Hi Sadik, Thank for your kind reply. but here we wanted to create second realm for separate AD forest on the same WSA. so it is possible or not? Regards, Keyur Patel.

[sadik.sener1]

Hi Keyur,

It is possible.

https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa11-0/user_guide/b_WSA_UserGuide/b_WSA_UserGuide_chapter_01001.html#con_1334317

• Create as few Active Directory realms as is practical. Multiple Active Directory realms require additional memory usage for authentication.

So your key point will still be to create a matrix , which subnets will be authenticated against which realms. 
If you're expecting WSA to query both realms and find the user belongs to which one, its not gonna work.

You should point WSA which domain to check.

Hope this helps

Sadik

[KEYURPATEL4854]

Hi Sadik,

We have a scenario like employees of two different companies(ex. company A and Company B) that are on the same premises and on the same subnet. Realm for company A was already created on WSA and it was working fine. Now we have to create the second realm for Company B employees on the same WSA. But the problem is the AD's of both companies are in a different forest. so it is possible? if yes please suggests the steps for doing the same. 

Regards,

Keyur