1

We have implemented Remote access VPN on ASA and integrate with onelogin cloud base OTP service, where we have LDAP server and onelogin provide RADIUS service to provide LDAP+OTP base authentication.

In my VPN config we just tell use onelogin RADIUS for authentication and everything working fine but now if i want to create multiple Group and provide authentication base on group and set ACL, how can i do that?

This is what we have, EMPLOYEE group and now i want to create other group which has only 2 users called CONTRACTOR and i want them not to authenticate using EMPLOYEE profile.

aaa-server ONELOGIN (outside) host 201.XX.XX.12
 key *****
 authentication-port 1812
 accounting-port 1813

tunnel-group EMPLOYEE type remote-access
tunnel-group EMPLOYEE general-attributes
 address-pool ANYCONNECT-POOL-EMPLOYEE
 authentication-server-group ONELOGIN
 default-group-policy GroupPolicy_ANYCONNECT-EMPLOYEE

UPDATE

for testing i have installed freeradius in my lab and bind with LDAP and here is the sample configuration.

Freeradius config in post-auth section

if (LDAP-Group == "sales" ) {
    update reply {
                    Class = OU=GroupPolicy_ANYCONNECT-SALES;
                Reply-Message = "You are Accepted"
            }
     }
    elsif (LDAP-Group == "finance" ) {
        update reply {
                    Class = OU=GroupPolicy_ANYCONNECT-FINANCE;
            Reply-Message = "You are Accepted"
        }
    }
    else {
        reject
    }

ASA config:

group-policy GroupPolicy_ANYCONNECT-SALES internal
group-policy GroupPolicy_ANYCONNECT-SALES attributes
 dns-server value 10.0.0.10 10.0.0.11
 vpn-filter value VPN-FILTER-SALES
 vpn-tunnel-protocol ssl-client
 group-lock value SALES
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value ANYCONNECT-SALES
 default-domain value sales.com
!
!
tunnel-group SALES type remote-access
tunnel-group SALES general-attributes
 address-pool ANYCONNECT-POOL
 authentication-server-group RADIUS
 default-group-policy GroupPolicy_ANYCONNECT-SALES
tunnel-group SALES webvpn-attributes
 group-alias SALES enable

I am seeing ASA VPN allowing user A to authenticate in both tunnel, how do i lock down so user A won’t be able to authenticate in Finance and user B won’t be authenticate to Sales, in short user can only authenticate to own group profile.

  • If you create a separate tunnel-group for CONTRACTORs then your RADIUS auth will have either the attribute: Cisco-VPN-Tunnel-Group-Name = "CONTRACTOR", or Cisco-VPN-Tunnel-Group-Name = "EMPLOYEE". It will then be up to onelogin to distinguish. – ericx Oct 24 '17 at 13:44
  • i will check with onelogin vendor, we have LDAP server in house so can i tell ASA to check MemberOf and if it's not part of group then deny user – Satish Oct 24 '17 at 18:23
  • I asked onelogin and they said they have no such feature at preset. :( – Satish Oct 25 '17 at 13:32
  • Is there any way i can create local database or userlist and tell asa not allow them to authenticate to X group? – Satish Oct 25 '17 at 13:33
  • is there any other work around? can i create two web portal on Cisco ASA and one for contractor.asa.com and other one employee.asa.com ? – Satish Oct 26 '17 at 16:19
2

Solution:

This is what i did on radius, map TunelGroupName= ASA attributes with ldap group. and its working now.

/etc/raddb/users

DEFAULT Ldap-Group == "cn=sales,cn=groups,cn=compat,dc=example,dc=com", ASA-TunnelGroupName = "SALES"
DEFAULT Ldap-Group == "cn=hr,cn=groups,cn=compat,dc=example,dc=com", ASA-TunnelGroupName = "HR"
  • You should accept your answer so that the question doesn't keep popping up forever, looking for an answer. – Ron Maupin Nov 8 '17 at 15:35
  • You got that one. – Satish Nov 8 '17 at 15:40
0

On the ASA, this is regularly achieved through the assignment of different group policies to different users. When LDAP authentication is in use, this can be achieved automatically with an LDAP attribute map. In order to use LDAP to assign a group policy to a user, you must map an LDAP attribute, such as the AD attribute memberOf to the Group-Policy attribute that is understood by the ASA. Once the attribute mapping is established, you must map the attribute value configured on the LDAP server to the name of a group policy on the ASA.

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/91831-mappingsvctovpn.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.