Authentication by group in LDAP for VPN without DAP?

Question

Is there a way to allow access to SSLVPN services based on groups in AD without configuring DAP? I know with DAP you can easily do this - however - the company that manages the firewall would have to create a 'service exception' for this type of config - which takes a long time and the asking party would like to move ahead with a solution rapidly, so I'm looking for alternatives.

Answer 1

Would using Radius be an option? You can differentiate AD groups using radius attribute 25 (class). Full walk through from Jeff Boyer on the Cisco forums may be found at:

https://supportforums.cisco.com/docs/DOC-15074