ACS - Device Group Mapping

[lee.reade]

Hi,

Have a requirement to setup ACS 3.2 with group mapping to internal Active Directory domain for authentication, however this setup will have multiple NAS and it is required that depending on which NAS a user accesses the network via, the group mapping that is applied to the user.

For example, a user connects via a vpn through pixa and should be assigned the group vpn, whereas another user connects via an anologue access server as should be assigned the group dial-in. Also note that no user will be tied to any access method, ie a user could use the dial up or vpn access method.

Although I cannot fathom how to achieve this, if at all.

Any ideas people?

Cheers,

LR

[vmoopeung]

You can combine the ACS and Active directory users.

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00801df0e4.shtml

[ramos1]

Unfortunately, ACS server only supports one active group mapping for a given user. So if you have two different groups that users will be members of at the same time, ACS will dynamically map them to the group which occurs first in the list in your group mapping config (under External User DB's - DB Group Mappings). That will be the one and only group to which the user belongs as far as ACS is concerned.

You might want to try combining group settings into one so that all necessary services are available in either situation, then use NAR's to tighten down who goes where, when, etc..

[lee.reade]

Thanks for the input, however;

How would you use the NARs to restrict a user in this manner. Remember in this case a certain user could access the network via either the RAS and VPN devices, depending on which method the user uses.

The RAS users have only to access server A whilst the VPN users have to access the A & B (for example). If you have an ACS group mapping to an internal Active Directory domain group, then all users will be placed in that ACS group, as ACS will choose the first group map that it finds.

Can you advise if it is possible to achieve what I am looking for??

Cheers

LR