We have implemented Remote access VPN on ASA and integrate with onelogin cloud base OTP service, where we have LDAP server and onelogin provide RADIUS service to provide LDAP+OTP base authentication.

In my VPN config we just tell use onelogin RADIUS for authentication and everything working fine but now if i want to create multiple Group and provide authentication base on group and set ACL, how can i do that?

This is what we have, EMPLOYEE group and now i want to create other group which has only 2 users called CONTRACTOR and i want them not to authenticate using EMPLOYEE profile.

aaa-server ONELOGIN (outside) host 201.XX.XX.12
 key *****
 authentication-port 1812
 accounting-port 1813

tunnel-group EMPLOYEE type remote-access
tunnel-group EMPLOYEE general-attributes
 authentication-server-group ONELOGIN
 default-group-policy GroupPolicy_ANYCONNECT-EMPLOYEE


for testing i have installed freeradius in my lab and bind with LDAP and here is the sample configuration.

Freeradius config in post-auth section

if (LDAP-Group == "sales" ) {
    update reply {
                    Class = OU=GroupPolicy_ANYCONNECT-SALES;
                Reply-Message = "You are Accepted"
    elsif (LDAP-Group == "finance" ) {
        update reply {
                    Class = OU=GroupPolicy_ANYCONNECT-FINANCE;
            Reply-Message = "You are Accepted"
    else {

ASA config:

group-policy GroupPolicy_ANYCONNECT-SALES internal
group-policy GroupPolicy_ANYCONNECT-SALES attributes
 dns-server value
 vpn-filter value VPN-FILTER-SALES
 vpn-tunnel-protocol ssl-client
 group-lock value SALES
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value ANYCONNECT-SALES
 default-domain value sales.com
tunnel-group SALES type remote-access
tunnel-group SALES general-attributes
 address-pool ANYCONNECT-POOL
 authentication-server-group RADIUS
 default-group-policy GroupPolicy_ANYCONNECT-SALES
tunnel-group SALES webvpn-attributes
 group-alias SALES enable

I am seeing ASA VPN allowing user A to authenticate in both tunnel, how do i lock down so user A won’t be able to authenticate in Finance and user B won’t be authenticate to Sales, in short user can only authenticate to own group profile.

  • If you create a separate tunnel-group for CONTRACTORs then your RADIUS auth will have either the attribute: Cisco-VPN-Tunnel-Group-Name = "CONTRACTOR", or Cisco-VPN-Tunnel-Group-Name = "EMPLOYEE". It will then be up to onelogin to distinguish.
    – ericx
    Oct 24, 2017 at 13:44
  • i will check with onelogin vendor, we have LDAP server in house so can i tell ASA to check MemberOf and if it's not part of group then deny user
    – Satish
    Oct 24, 2017 at 18:23
  • I asked onelogin and they said they have no such feature at preset. :(
    – Satish
    Oct 25, 2017 at 13:32
  • Is there any way i can create local database or userlist and tell asa not allow them to authenticate to X group?
    – Satish
    Oct 25, 2017 at 13:33
  • is there any other work around? can i create two web portal on Cisco ASA and one for contractor.asa.com and other one employee.asa.com ?
    – Satish
    Oct 26, 2017 at 16:19

2 Answers 2



This is what i did on radius, map TunelGroupName= ASA attributes with ldap group. and its working now.


DEFAULT Ldap-Group == "cn=sales,cn=groups,cn=compat,dc=example,dc=com", ASA-TunnelGroupName = "SALES"
DEFAULT Ldap-Group == "cn=hr,cn=groups,cn=compat,dc=example,dc=com", ASA-TunnelGroupName = "HR"
  • You should accept your answer so that the question doesn't keep popping up forever, looking for an answer.
    – Ron Maupin
    Nov 8, 2017 at 15:35
  • You got that one.
    – Satish
    Nov 8, 2017 at 15:40

On the ASA, this is regularly achieved through the assignment of different group policies to different users. When LDAP authentication is in use, this can be achieved automatically with an LDAP attribute map. In order to use LDAP to assign a group policy to a user, you must map an LDAP attribute, such as the AD attribute memberOf to the Group-Policy attribute that is understood by the ASA. Once the attribute mapping is established, you must map the attribute value configured on the LDAP server to the name of a group policy on the ASA.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.