0

We have ASA units that have tunnel-groups that have a particular group-policy defined via default-group-policy statement. This initial group-policy ("NOACCESS") is one that prevents any logins via the use of vpn-simultaneous-logins 0 statement. However, upon user authentication (done via RADIUS protocol), the group-policy is somehow changed to one of a few we have defined, depending on the value of the RADIUS "Class" attribute (attribute 25) set on the user record. The "replacement" group-policy has a positive number set for the value of vpn-simultaneous-logins which then lets the user establish up to "n" simultaneous sessions.

My question is, how is this done? (we had a VAR CCIE set this up quite a few years ago, and "it just worked" so we didn't record the nitty-gritty details at the time, but now I want to know...)

Improve this question
4
  • You will need to post a sanitized copy of your running-config, otherwise we're just guessing at how things are set on your device. Also, we can only troubleshoot the ASA side of the equation, as configuring the RADIUS server is off topic for this site.
    – Jesse P.
    Sep 16, 2020 at 22:22
  • You pretty much answered your own question. RADIUS tells the system which profile to apply.
    – Ricky
    Sep 17, 2020 at 0:02
  • @Ricky Beam - ok, but how does that happen? The ASA just “knows” to look at the value in attr 25 (which is “OU=xxxx”, where xxxx is the group-policy name), or is it some config somewhere? (that I can’t seem to find...)
    – Will Dennis
    Sep 17, 2020 at 4:28
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Dec 17, 2020 at 21:35

1 Answer 1

Reset to default
1

As it turns out, it's a built-in feature of the ASA... From "Cisco ASA: All-in-One Next-Generation Firewall, IPS, and VPN Services, Third Edition" (Cisco Press, 2014), Chapter 20:

[...] you can even control user access and policy mapping from an external authentication server. Pass the user group policy name as a RADIUS or LDAP attribute to the security appliance. By doing so, you guarantee that a user always gets the same policy, regardless of the tunnel group name to which the user connects. If you are using RADIUS as the authentication and authorization server, you can specify the user group policy name as attribute 25 (class attribute). [Pre]pend the keyword OU= [to] the value of the class attribute. For example, if you define a user group policy called engineering, you can enable attribute 25 and specify OU=engineering as its value.

I can see in our RADIUS server this is just what we have done, and so, mystery solved!

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.