Is there a way to allow access to SSLVPN services based on groups in AD without configuring DAP? I know with DAP you can easily do this - however - the company that manages the firewall would have to create a 'service exception' for this type of config - which takes a long time and the asking party would like to move ahead with a solution rapidly, so I'm looking for alternatives.

1 Answer 1


Would using Radius be an option? You can differentiate AD groups using radius attribute 25 (class). Full walk through from Jeff Boyer on the Cisco forums may be found at:


  • That looks like it could fit the bill tysm!
    – A L
    Jun 27, 2013 at 19:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.