2

I've configured the ASA for LDAP authentication and successfully tested with the "Test aaa-server" command. However when I attempt to connect via Clientless VPN, I am unable to log in. Local users are able to log in via Clientless VPN.

I am truly unsure how I would even begin to troubleshoot this issue.

Edit: Redacted some non-essential information (reason being that the test aaa-server test tools verifies that the aaa server is authenticating correctly, AKA everything on the inside is working as intended. Correct me if I'm wrong.)

Model: 5508-x
Software Version: 9.6(4)3

aaa-server Users_VPN protocol ldap
aaa-server Users_VPN (inside) host REDACT
 ldap-base-dn REDACT
 ldap-naming-attribute REDACT
 ldap-login-password REDACT
 ldap-login-dn REDACT
 server-type REDACT
user-identity default-domain LOCAL
aaa authentication http console LOCAL 
aaa authentication enable console LOCAL 
aaa authentication ssh console LOCAL 
aaa authentication telnet console LOCAL 
aaa authorization command LOCAL
Improve this question
4
  • You need to give us more information. At the least, we need to know the model, software version, configuration, and any logs, debugs, etc. that demonstrate the problem. Please edit you question to include as much relevant information as possible.
    – Ron Maupin ♦
    Mar 15, 2018 at 20:32
  • @RonMaupin sorry, I've updated my post.
    – Racehorse35
    Mar 15, 2018 at 20:50
  • Removing comment, didn't read carefully and I thought you were using AnyConnect.
    – boomi
    Mar 15, 2018 at 21:51
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Apr 1, 2018 at 23:03

2 Answers 2

Reset to default
3

None of your aaa commands reference your aaa-server, only Local.

Try this....you will need to reference it for each aaa auth line you want to use it for.

aaa authentication http console Users_VPN LOCAL

For WebVPN, you will need to add the the server to your tunnel-group attributes. Like the previous aaa config, the radius server will always be used if it is reachable, appending the LOCAL will still access for those users if the radius server fails.

(config)#tunnel-group "yourtunnelgroup" general-att
(config-tunnel-general)#authentication-server-group Users_VPN LOCAL
Improve this answer
6
  • This definitely seems like it would be the issue. I have a question as to what this configuration would do (I have to implement this directly into a prod environment, sadly no test environment). Would this only use Users_VPN as the authentication tool as long as the AAA sever is accessible? As it stands, there are still local accounts that need to have access.
    – Racehorse35
    Mar 16, 2018 at 12:41
  • Check Cisco documentation, this command would not check the local database as long as the AAA is accessible. Is it possible to add in aaa authentication http console Users_VPN in addition to the config I already have in place to allow checking of the AAA database as well as the LOCAL database?
    – Racehorse35
    Mar 16, 2018 at 12:58
  • Sorry, I meant I Checked Cisco documentation. Not telling you to check it
    – Racehorse35
    Mar 16, 2018 at 14:12
  • No worries, when you say clientless vpn, are you referring to WebVPN on the ASA? If so, can you post your VPN config? And what are local users used for on the ASA, do you not want to use LDAP to authenticate for management access?
    – A-A-Ron
    Mar 16, 2018 at 14:18
  • Yes, I am referring to the WebVPN on the ASA. My only concern right now is that implementing your config modification will deny LOCAL database users access to the VPN, which I cannot do on a production environment. I am almost 100% sure your suggestion is correct, I will likely implement it after hours and let you know if it works!
    – Racehorse35
    Mar 16, 2018 at 14:26
1

When you attempt to connect to the ASA using Clientless VPN, the ASA will test your credentials against whatever is configured in the 'DefaultWEBVPNGroup' tunnel-group. Therefore, you need to add config similar to:

tunnel-group DefaultWEBVPNGroup general-attributes
 authentication-server-group Users_VPN

This will cause all Clientless VPN users to be authenticated against LDAP. If you have users in the local database, too, then you can either (1) add those users to the LDAP directory, or (2) configure group aliases, which allow the user to select which tunnel-group they're going to login to, which in turn determines which user database (LDAP or local) will be used.

Here's a link to some documentation on group aliases.

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/98580-enable-group-dropdown.html

As a side note, all those aaa authentication commands are for management traffic only. So, ASDM, SSH, etc.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.