ASA anyconnect VPN restriction base on group

Question

We have implemented Remote access VPN on ASA and integrate with onelogin cloud base OTP service, where we have LDAP server and onelogin provide RADIUS service to provide LDAP+OTP base authentication.

In my VPN config we just tell use onelogin RADIUS for authentication and everything working fine but now if i want to create multiple Group and provide authentication base on group and set ACL, how can i do that?

This is what we have, EMPLOYEE group and now i want to create other group which has only 2 users called CONTRACTOR and i want them not to authenticate using EMPLOYEE profile.

aaa-server ONELOGIN (outside) host 201.XX.XX.12
 key *****
 authentication-port 1812
 accounting-port 1813

tunnel-group EMPLOYEE type remote-access
tunnel-group EMPLOYEE general-attributes
 address-pool ANYCONNECT-POOL-EMPLOYEE
 authentication-server-group ONELOGIN
 default-group-policy GroupPolicy_ANYCONNECT-EMPLOYEE

UPDATE

for testing i have installed freeradius in my lab and bind with LDAP and here is the sample configuration.

Freeradius config in post-auth section

if (LDAP-Group == "sales" ) {
    update reply {
                    Class = OU=GroupPolicy_ANYCONNECT-SALES;
                Reply-Message = "You are Accepted"
            }
     }
    elsif (LDAP-Group == "finance" ) {
        update reply {
                    Class = OU=GroupPolicy_ANYCONNECT-FINANCE;
            Reply-Message = "You are Accepted"
        }
    }
    else {
        reject
    }

ASA config:

group-policy GroupPolicy_ANYCONNECT-SALES internal
group-policy GroupPolicy_ANYCONNECT-SALES attributes
 dns-server value 10.0.0.10 10.0.0.11
 vpn-filter value VPN-FILTER-SALES
 vpn-tunnel-protocol ssl-client
 group-lock value SALES
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value ANYCONNECT-SALES
 default-domain value sales.com
!
!
tunnel-group SALES type remote-access
tunnel-group SALES general-attributes
 address-pool ANYCONNECT-POOL
 authentication-server-group RADIUS
 default-group-policy GroupPolicy_ANYCONNECT-SALES
tunnel-group SALES webvpn-attributes
 group-alias SALES enable

I am seeing ASA VPN allowing user A to authenticate in both tunnel, how do i lock down so user A won’t be able to authenticate in Finance and user B won’t be authenticate to Sales, in short user can only authenticate to own group profile.

Answer 1

Solution:

This is what i did on radius, map TunelGroupName= ASA attributes with ldap group. and its working now.

/etc/raddb/users

DEFAULT Ldap-Group == "cn=sales,cn=groups,cn=compat,dc=example,dc=com", ASA-TunnelGroupName = "SALES"
DEFAULT Ldap-Group == "cn=hr,cn=groups,cn=compat,dc=example,dc=com", ASA-TunnelGroupName = "HR"

Answer 2

On the ASA, this is regularly achieved through the assignment of different group policies to different users. When LDAP authentication is in use, this can be achieved automatically with an LDAP attribute map. In order to use LDAP to assign a group policy to a user, you must map an LDAP attribute, such as the AD attribute memberOf to the Group-Policy attribute that is understood by the ASA. Once the attribute mapping is established, you must map the attribute value configured on the LDAP server to the name of a group policy on the ASA.

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/91831-mappingsvctovpn.html