Attribute LDAP AnyConnect Map

I'm trying to configure the attribute map for our SSL Anyconnect Client connections. Basically I want all connections to be deleted, unless the AD attribute numbering is set to allow users.

I have it working. But according to the instructions of Cisco, you create a group policy for NoAccess as your default strategy for your connection profile and kinematics-connections set to 0. The idea being to all connections will be dropped unless they use a different group strategy. As soon as I change my strategy of group - by default-NoAccess, I can not connect.

ldap attribute-map LDAPVPN
map-name msNPAllowDialin IETF-Radius-Class
map-value msNPAllowDialin FALSE NOACCESS
map-value msNPAllowDialin TRUE SSL-VPN

aaa-server LDAP protocol ldap
aaa-server LDAP (inside) host 192.200.202.5
server-port 389
ldap-base-dn dc=*****,dc=com
ldap-scope subtree
ldap-naming-attribute sAMAccountName
ldap-login-password *****
ldap-login-dn CN=cisco,OU=Service,OU=Accounts,OU=*****,DC=******,DC=com
server-type microsoft
ldap-attribute-map LDAPVPN

group-policy SSL-VPN internal
group-policy SSL-VPN attributes
dns-server value 192.200.202.5 192.200.202.6
vpn-tunnel-protocol svc
split-tunnel-policy tunnelspecified
split-tunnel-network-list value VPN-Tunnel
group-policy NoAccess internal
group-policy NoAccess attributes
vpn-simultaneous-logins 0
vpn-tunnel-protocol IPSec svc
webvpn
svc ask none default svc

tunnel-group SSL-VPN type remote-access
tunnel-group SSL-VPN general-attributes
address-pool ssl-pool
authentication-server-group LDAP
default-group-policy NoAccess
tunnel-group SSL-VPN webvpn-attributes
group-alias ******* enable

 If I check debug you can see the attribute being mapped correctly. What gives?

test aaa authorization LDAP host 192.200.202.5 username ****

[333]   msNPAllowDialin: value = TRUE

    [333]           mapped to IETF-Radius-Class: value = SSL-VPN

    [333]           mapped to LDAP-Class: value = SSL-VPN

Hello, please follow these steps:

attributes of SSL - VPN group policy

VPN - connections 3

What is happening here is that the SSL - VPN group policy inherits the value 0 of concurrent vpn connections to NoAccess policy as soon as set you it uo as default group policy under the tunnel-group. That's why we need to specifically add value on SSL - VPN group policy.

Tags: Cisco Security

Similar Questions

Wildcard to attribute LDAP - IPSEC not WebVPN

Hello

I have installation using LDAP authentication and it works fine.

I'm trying to limit to only users who are members of a security group (VPN users) to VPN in.

I created a map to attribute LDAP (vpnmap) that checks if the user is a member of the required security group and if correct assigns a group policy (XXXvpntunnel).

However, if a user is not a member of the group, the plan of ldap attribute does not affect Group Policy above it, but the user can always VPN in and when I do a check for group policy being used sh vpn-sessiondb remote detail, it shows me the same XXXvpntunnel used group policy.

I created another group policy called XXXvpntunneldeny with ipsec sessions set to 0, but how can I assign this profile to group users who aren't a memberOf VPN users, so that they can not VPN in?

I also tested by adding SamAccountname in the map of the attribute and the value "Administrator" and "xxxvpntunneldeny" group policy and it stops falling administrator in the via the VPN, but I want to be able to use a wildcard character to prevent all users not in the security VPN users group to connect through the VPN.

Any suggestions on the best way to prevent users are not part of the VPN users group in AD to VPN in?

Thank you.

Here is a good link http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008089149d.shtml

modify the group policy by default for vpn - concurrent connections 0

apply a vpn simultaneous connections in the new group policy-specific.

attributes of Group Policy DfltGrpPolicy

VPN - concurrent connections 0

Group POLICY-policy attributes

VPN - 10 concurrent connections

I was able to get this to work.

forget the mapping for the call permissions. not necessary here.

If someone are mapped to one of your manually created group policies, only default group policy applies, and they are unable to open a session.

(LDAP) provider mapping alias
Hello

I use content webcenter 11g, my team mapped attributes user the LDAP with accounts and roles at the time and works without any problem.

But know not that I need another mapping of attributes. Is it possible to do the same thing with the alias?

Thank you
For after this post: Re: notification URM instead of users. role-based is not possible (STANDARD).

ACS 4.2 RSA Authentication and LDAP group mapping

Hello

I have a firewall, PaloAlto, with overall protection enabled (SSL - VPN) feature

I use Cisco Secure ACS as a proxy for the RSA SecurID authentication.

After authentication is try to map ad through LDAP query groups.

The question I've found, is that the user I get with user authentication has no field:

Show user ip-user-mapping all | mbm60380 game

10.240.1.24 vsys1 UIA 2388 2388 domain\mbm60380

10.240.1.1 vsys1 UIA 2101 2101 domain\mbm60380

10.240.250.1 mbm60380 2590859 2590859 vsys2 GP

But the list of users that I receive from the LDAP query includes the domain prefix:

See the user group name domain\group1 property

short name: domain\group1

[1] domain\aag60368

[2] domain\ced61081

[3] domain\jas61669

[4] domain\mbm60380

[5] domain\pmc61693

[6] domain\vcm60984

I would like to create the user with the area of GBA but it must delete the domain before querying the RSA server, as it does not support field stripping.

I tried to fix this on the Palo Alto firewall without success.

I'm trying to run Cisco Secure ACS 4.2 changing, but it did not work either:

RSA servers are configured as an external database. They are not defined in the groups of network devices.

Can I set up domain stripping for queries servers RSA?

Thank you

Hello

I think it should work, but it is a bit awkward:

Create an entry in the Distribution of Proxy in the Network Configuration.

DOMAIN\\USER *.

Prefix

Before returning to the AAA server, from there to authenticate to the server RSA without the domain prefix.

Make sense?

Thank you

Chris

Change the attribute - Configuration Item mapping in task Scriptable

Hello
is it possible to change the mapping of attributes to the elements of configuration with a scriptable tasks?
Or do I have to map all possible configuration to decide later that you use attributes?
example:
configuration 1:
UC = 4
memory = 8
disk_size = 16
configuration 2:
UC = 2
memory = 4
disk_size = 8
Is it possible to have only three attributes (processors, memory, disk_size) and configuration card 2 via the script task or 1 configuration?
Or should I do 6 attributes (cpus1, cpus2, memory1, memory2, disk1, disk2) a static mapping and use three of the six possible attributes?
Thank you
Michael

The way I saw this fact is as follows:

Define a ConfigurationElement (called configElement in the example below) as an attribute to your workflow.

Create items in the ConfigurationElement prefixed by your size or configuration. (Ex: small_cpu, large_cpu, small_memory, large_memory, etc.).

In your task scriptable:

var cpuAttr = configElement.getAttributeWithKey (size + "_cpu");

var cpu = cpuAttr.value;

var memoryAttr = configElement.getAttributeWithKey (size + "_memory");

memory of var = memoryAttr.value;

Mapping of LDAP attributes

If you use LDAP attributes to map users to a specific group on the SAA is it necessary for group lock if I want a user to connect to a single group? I use the Cisco-Group Policy attribute to map an LDAP attribute = an employee service e.g. sales, marketing, research, etc..

Kind regards

Charles

No, if you already configure map LDAP attribute, then there is no need to configure Group locking because map LDAP attribute will automatically map the user to the specific group policy you have created through mapping.

Hope that answers your question.

LDAP attribute on user card match no group

We currently have Anyconnect (client based) up and running on our ASA 5515 X 9.5 (1) running. I use AD LDAP for authentication and configuration of LDAP attribute maps and assigned to our LDAP on the ASA server config. Like many, we use these cards to allow ASA assign a group policy to a user based on the AD group membership. Basically I have one AD Group for regular of VPN users and a group for users Admin VPN advertising. It works pretty well, but there are cases where the user profile specific related to group policy 'Regular users of VPN' does not work for all users of this ad group. I was trying to find a way to adjust the settings for certain users based on the user name. Say the user needs setting up VPN from an RDP session, but I'm not all users have that so I would attribute a group different local\Configuration user profile based on the AD username that would allow the VPN from a RDP session. Still, the rest of the users would be blocked to the RDP VPN. Here is my map to attribute LDAP database:

map-attribute LDAP
name of the memberOf Group Policy map
map-value memberOf "LDAP path."
msRADIUSFramedIPAddress IETF-RADIUS-Framed-IP-Address card name

Now I could do here with the above configuration, I think it's to create a new group policy on the SAA for a certain group of users and then create a new value of the card with a new LDAP path that would point to a new group in AD, say "RDP VPN users". I then add the users I want Anyconnect group policies\user specific profiles for this particular ad group. But the question is that I would prefer not to have to create as many groups in AD.

I want to know is if there is a way to have a path of card value of LDAP attribute to a certain username AD somehow. As if the LDAP path was something like "CN =, OU = users, DC =, DC ='.»» This way I could affect a group policy to the majority of users in the group "Regular users of VPN" AD, but then assign a different policy to some users who require slightly different settings. That would allow me to match on a certain user, not one ad group? The Group cisco-attribute-name strategy addresses a user as if it were an ad group? I guess not, but not sure. I looked through the list of names of attributes-cisco - but didn't see anything that looked like it worked for AD user names.

Also, if anyone knows a better way please let me know I am open to suggestions. I hope that makes sense. Thanks in advance to the community for help.

I think that you need a completely different approach - DAP (dynamic access policies).

DAP allows a lot of motion of things, and you can create additive strategies. So if you are a member of the group 'A' you add to this URL. If you are also a member of the group 'B' you add this ACL. If it can also do other things, like checking the registry keys, etc.

The Guide deployment of DAP.

https://supportforums.Cisco.com/document/7691/ASA-8X-dynamic-access-policies-DAP-deployment-guide

I pretty much don't use DAP now (and no attribute is mapped) due to the significant increase in flexibility.

ANyConnect Client certificate authentication and verify the Client against the Microsoft AD using DAP via LDAP domain membership

Hello

as described in the title one want to connect with AnyConnect Secure Mobility Client 3.0.2052 ASA 5540 Version 8.4 and licence Premium SSL.

Customers using Maschine certificate to authenticate to ASA. It works very well.

Now, I want to install a DAP to check the customer against the Microsoft AD using LDAP. I have configured the LDAP server in see ASA:

AAA-Server LDAP protocol ldap

AAA-Server LDAP (inside) host ldap.com

LDAP-base-dn DC = x DC = x, DC = x DC = com

LDAP-scope subtree

LDAP-login-password *.

LDAP-connection-dn *.

microsoft server type

I see that it works if I test via the testbotton server in ASDM and I also see in CLI "debugging ldap 255". But if I configure in DAP: AAA attribute ID:memberOf = Membre_domaine I can't see any request to the LDAP server as I try to connect with the Client und does not correspond to the DAP.

No idea where the problem lies?

Thanks in advance

Hi Klaus,

DAP will not make any call LDAP itself, it will only act based on the attributes received LDAP via the LDAP authentication or authorization.

So you will need to enable the LDAP authorization in the tunnel - or connect to groups.

Once you have, you can either use DAP or a map attribute LDAP for accept/deny access, see the example of these two methods.

HTH

Herbert

AnyConnect dynamic address pool

It is possible using DAP to assign the different address for anyconnect users pool?

Currently, I check if the PC has some elements such as process, save the key and activated applications.

If yes-> ACL using "allow normal access.

Is not-> ACL uses 'access '.

That works, but two computers uses the pool of customer addresses defined in the configuration of the Tunnel

tunnel-group remoteaccess General attributes
remoteaccess-pool1 address pool

It is possible to also dynamically set the address pool?

If yes-> ACL using 'Allow normal access' & 'remoteaccess-pool1'

SE not-> 'Access restricted' ACL uses & "remoteaccess-pool2.

Thank you!

Rolando A. Valenzuela.

Hello Rolando,

Correct than me if I'm wrong, based on the computer (the domain to which it belongs) that you want to map to some Grouppolicy, which has some qualities as the pool of addresses, and that way you can establish a distinction, one area to the other, let's say:
(Admins/domain gets the address pool of 10.10.10.0/24)
(Suppliers/field gets the address pool of 10.20.20.0/24)

Based on this I will give you my recommendations, if you want to do it based on the computer and not the user, I recommend you to get all the computers in the same group of users in Active Directory, so if you have a group of users (Admin / domain group) you can add computers, and with the LDAP Mapping attribute you can map based on membership in a specific political group in this way, all computers that use of Admin users, will be assigned to a group policy with several attributes, such as the Pool of local IP, if users don't below any of the advertised groups, they will not be able to connect either, because you will need create a group policy NO ACCESSIBLE to be used for users who should not connect You can find more information here:

- http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-nex...

Another medium, will be filtering the PC based on the MAC address, YES this function uses a regular expression to match the organizational (YES) the unique identifier that will allow the PC connect so those that match the program defined in the regular expression with Regex LUA , this is possible, you can find this regular expression, for example :
```
assert(function ()    local pattern = "^d067\.e5*"    local true_on_match = true

    local match = false    for k,v in pairs(endpoint.device.MAC) do        print(k)        match = string.find(k, pattern)        if (match) then            if (true_on_match) then                return true            else return (false)            end        end    endend)()
```
If the PC is HP or Dell, you can use the MAC address YES part and set it there and allow the user to connect, and the user peuvent then be mapped with the Protocol LDAP attribute mapping to a group policy so they will be able to connect with a different IP address. (DAP cannot assign IP address), it's a dynamic access policy that works with HostScan Module of Posture to do a preliminary assessment and as he says unit of Posture, NOTE: PAH itself gives you the ability to filter by individual MAC address, so you don't need to do it by YES, this is common for large companies that have a large amount of users , so they prefer to make Yes that is easier, but you can set the MAC address of another way will be to use another regular expression so DAP can examine the first 3 letters (Case Insensitive) of the PC and then allow it to connect if it matches the regex, if it's not, the connection ends, you can find the regular expression here :
```
assert(function()    local match_pattern = "^[Mm][Ss][Vv]"         -> Those are the 3 first letters    local match_value   = endpoint.device.hostname  --> Specifying hostname      if (type(match_value) == "string") then        if (string.find(match_value, match_pattern) ~= nil) then            return true        end    elseif (type(match_value) == "table") then        local k,v        for k,v in pairs(match_value) do            if (string.find(v, match_pattern) ~= nil) then                return true            end        end    end    return falseend)()
```
In addition to regular expressions of LUA:- http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-nex... To do this you must License Premium AnyConnect (then Yes you can use the default two value that comes with the ASA). Also, you must have image CSD or Hostscan in ASA and activated so that you can get that kind of information about the computers that connects the AnyConnect. You can use the AnyConnect image like hostscan image. (do not forget to activate the attributes of endpoint through Deputy Ministers, DEPUTIES of the section of the CSD, otherwise it won't work). The previous mentioned is good options for you to explore, but it will not be very scalable (depending on number of users), so I recommend than a registry key with check check "Domain name" or file would work well but its your CUs call if he wants to still check MAC or not. Please do not forget to rate and score as correct this message if it helped, keep me posted! Best regards, David Castro,

Two remote AnyConnect clients cannot get two voice via softphones?

We have a situation where two remote users of SSL VPNS cannot establish a voice call via softphones or cookie lync. They can both talk but I can't hear the other. Each user can call external or the office LAN without problems.

I'm under ASA version 9.1 (5) and v.3.1.05170 AnyConnect. Pretty basic config (purified) - any help would be appreciated!

# sh run
: Saved
:
ASA Version 9.1 (5)
!
host device name
something.com domain name
activate the encrypted password
volatile xlate deny tcp any4 any4
volatile xlate deny tcp any4 any6
volatile xlate deny tcp any6 any4
volatile xlate deny tcp any6 any6
volatile xlate deny udp any4 any4 eq field
volatile xlate deny udp any4 any6 eq field
volatile xlate deny udp any6 any4 eq field
volatile xlate deny udp any6 any6 eq field
encrypted passwd
names of
General pool of local pool IP 10.x.x.x - 10.x.x.y
IP local pool pool-ops-TI 10.y.y.y - 10.y.y.z

interface GigabitEthernet0/0
nameif outside
security-level 0
IP x.x.x.x where x.x.x.x
!
interface GigabitEthernet0/1
description of the inside interface
nameif inside
security-level 100
IP address y.y.y.y y.y.y.y
!
interface GigabitEthernet0/2
Shutdown
No nameif
no level of security
no ip address
!
interface GigabitEthernet0/3
Shutdown
No nameif
no level of security
no ip address
!
interface GigabitEthernet0/4
Shutdown
No nameif
no level of security
no ip address
!
interface GigabitEthernet0/5
Shutdown
No nameif
no level of security
no ip address
!
interface GigabitEthernet0/6
Shutdown
No nameif
no level of security
no ip address
!
interface GigabitEthernet0/7
Shutdown
No nameif
no level of security
no ip address
!
interface Management0/0
management only
Shutdown
No nameif
no level of security
no ip address
!
banner login ***********************************************************************
connection of the banner! ONLY AUTHORIZED USERS ARE ALLOWED TO CONNECT UNDER PENALTY OF LAW.
connection of the banner is a computer network that is private and can be used only in direct
banner connection explicit owner. The owner reserves the right to
banner connection monitor use this network to ensure the security of networks and respond
banner connect on specific allegations of misuse. Use of this network must
the banner sign a consent to the monitoring of these or other purposes.
connection banner in addition, the owner reserves the right to consent to a valid
application of law banner connection to search the network for evidence of a crime
banner stored within the network connection.
banner login ***********************************************************************
banner asdm ***********************************************************************
asdm banner! ONLY AUTHORIZED USERS ARE ALLOWED TO CONNECT UNDER PENALTY OF LAW.
asdm banner is a computer network that is private and can be used only in direct
banner asdm explicit owner. The owner reserves the right to
banner asdm monitor use this network to ensure the security of networks and respond
asdm banner of specific allegations of misuse. Use of this network must
banner asdm you consent to the monitoring of these or other purposes.
asdm banner in addition, the owner reserves the right to consent to a valid
application of law banner asdm to search the network for evidence of a crime
asdm banner stored within the network.
banner asdm ***********************************************************************
boot system Disk0: / asa915-smp - k8.bin
passive FTP mode
clock timezone CST - 6
clock to summer time recurring CDT 1 Sun Mar 1 Sun Nov 02:00 02:00
DNS lookup field inside
DNS server-group DefaultDNS
Server name 192.168.0.0
Server name 192.168.0.0
something.com domain name
Local_LAN_Access list standard access allowed host 0.0.0.0
pager lines 24
Enable logging
timestamp of the record
exploitation forest-size of the buffer 40960
logging buffered stored notifications
logging trap notifications
record of the mistakes of history
notifications of logging asdm
logging - the id of the device hostname
logging inside 10.0.0.0 host
logging inside 10.0.0.0 host
Outside 1500 MTU
Within 1500 MTU
IP verify reverse path to the outside interface
IP verify reverse path inside interface
no failover
ICMP unreachable rate-limit 1 burst-size 1
ICMP allow any echo outdoors
ICMP allow any inaccessible outside
ICMP allow any inside
ASDM image disk0: / asdm - 721.bin
don't allow no asdm history
ARP timeout 14400
no permit-nonconnected arp
Route outside 0.0.0.0 0.0.0.0 x.x.x.x 1
Route inside 10.0.0.0 255.0.0.0 y.y.y.y 1
Route inside 192.168.0.0 255.255.0.0 y.y.y.y 1
Route inside 0.0.0.0 0.0.0.0 y.y.y.y in tunnel
Timeout xlate 03:00
Pat-xlate timeout 0:00:30
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
test_VPN card-attribute LDAP
name of the memberOf Group Policy map
map-value memberOf "CN = test VPN, OR = groups of VPN, OR = Groups, OU = company, DC =, DC =, DC = com" "test VPN".
dynamic-access-policy-registration DfltAccessPolicy
AAA-server test-deviceauth protocol ldap
Max - a attempts failed 5
AAA-server baird-deviceauth (inside) host 192.x.x.x
Server-port 636
LDAP-base-dn DC = x, DC =, DC = z
LDAP-scope subtree
LDAP-login-password
LDAP-connection-dn cn = b, OU = Service accounts, DC = x, DC =, DC = z
enable LDAP over ssl
microsoft server type
AAA-server test-rsa Protocol sdi
AAA-server test-rsa (inside) host
interval before attempt-3 new
AAA-server auth-ldap-tes ldap Protocol
AAA-server test-ldap-auth (inside) host
Server-port 636
LDAP-base-dn DC = country, DC = a, DC = com
LDAP-scope subtree
LDAP-login-password
LDAP-connection-dn CN = b, OU = Service accounts, DC = x, DC =, DC = z
enable LDAP over ssl
microsoft server type
LDAP-attribute-map test_VPN
identity of the user by default-domain LOCAL
the ssh LOCAL of baird-deviceauth console AAA authentication
HTTP authentication AAA console LOCAL baird-deviceauth
serial baird-deviceauth LOCAL console AAA authentication
Enable http server
http inside x.x.x.x y.y.y.y
HTTP 1.1.1.1 255.255.255.0 inside
redirect http outside 80
SNMP-server host inside x.x.x.x trap community version 2 c
SNMP server location
contact SNMP Server
SNMP-server community
Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start
Server enable SNMP traps entity power cpu-temperature
Crypto ipsec pmtu aging infinite - the security association
Crypto ca trustpoint trustpoint-selfsigned-vpncso
registration auto
FQDN
name of the object CN =, O =, C =, St =, =.
key pair
Configure CRL
Crypto ca trustpoint
Terminal registration
Configure CRL
Crypto ca trustpoint
Terminal registration
FQDN
name of the object CN = OR =, O =, C = St =, =.
key pair
Configure CRL
Crypto ca trustpoint
Terminal registration
Configure CRL
Crypto ca trustpoint
Terminal registration
Configure CRL
Crypto ca trustpoint
Terminal registration
Configure CRL
trustpool crypto ca policy

Telnet timeout 5
SSH enable ibou
SSH stricthostkeycheck
x.x.x.x inside SSH
SSH timeout 30
SSH version 2
SSH group dh-Group1-sha1 key exchange
Console timeout 15
No vpn-addr-assign aaa
No dhcp vpn-addr-assign
No ipv6-vpn-addr-assign aaa
no local ipv6-vpn-addr-assign
no statistical access list - a threat detection
no statistical threat detection tcp-interception
NTP server 1.1.1.1 source inside
NTP server 2.2.2.2 source inside
SSL-trust outside ASDM_TrustPoint0 point
WebVPN
allow outside
AnyConnect image disk0:/anyconnect-win-3.1.05170-k9.pkg 1
AnyConnect image disk0:/anyconnect-macosx-i386-3.1.05170-k9.pkg 2
AnyConnect profiles baird-client-profile disk0: / customer-baird - profile .xml
AnyConnect enable
attributes of Group Policy DfltGrpPolicy
value of banner! ONLY AUTHORIZED USERS ARE ALLOWED TO CONNECT UNDER PENALTY OF LAW.
value of banner is a computer network that is private and can be used only in direct
banner value explicit owner. The owner reserves the right to
banner value monitor use this network to ensure the security of networks and respond
the value of the banner of the specific allegations of misuse. Use of this network must
value of the banner a consent to the monitoring of these or other purposes.
value of server DNS 1.1.1.1 2.2.2.2
VPN - connections 2
client ssl-VPN-tunnel-Protocol
Split-tunnel-policy excludespecified
value of Split-tunnel-network-list Local_LAN_Access
something.com value by default-field
Split-dns value something.com, us.something.com
activate dns split-tunnel-all
the address value general-pool pools
WebVPN
use-smart-tunnel homepage
AnyConnect value dart modules, nam
AnyConnect value profiles baird-client-profile user type
AnyConnect ask flawless anyconnect
Group Policy 'test' internal
Group Policy attributes 'test '.
Split-tunnel-policy excludespecified
value of Split-tunnel-network-list Local_LAN_Access
activate dns split-tunnel-all
the address value it-ops-pool pools
internal testMacs group policy
attributes of the strategy of group testMacs
WINS server no
value of server DNS 1.1.1.1 2.2.2.2
client ssl-VPN-tunnel-Protocol
field default value xyz.com
username admin privilege 15 encrypted password
attributes global-tunnel-group DefaultRAGroup
test-rsa authentication-server-group
test-ldap-auth authorization-server-group
management of the password password-expire-to-days 10
tunnel-group DefaultRAGroup webvpn-attributes
the aaa authentication certificate
attributes global-tunnel-group DefaultWEBVPNGroup
test-rsa authentication-server-group
test-ldap-auth authorization-server-group
management of the password password-expire-to-days 10
tunnel-group DefaultWEBVPNGroup webvpn-attributes
the aaa authentication certificate
tunnel-group test remote access connection type
tunnel-group test-Connect General attributes
test-rsa authentication-server-group
test-ldap-auth authorization-server-group
management of the password password-expire-to-days 10
tunnel-group test connection webvpn-attributes
the aaa authentication certificate
allow group-url http://abc.xyz.com
allow group-url https://abc.xyz.rwbaird.com
type tunnel-group testMacs remote access
tunnel-group testMacs General-attributes
test-rsa authentication-server-group
test-ldap-auth authorization-server-group
Group Policy - by default-testMacs
management of the password password-expire-to-days 10
use-set-name of the secondary-username-of-certificate
tunnel-group testMacs webvpn-attributes
allow group-url http://abc.xyz.com/macs
allow group-url https://abc.xyz.com/macs
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
Review the ip options
inspect the netbios
inspect the rsh
inspect the rtsp
inspect the skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect the tftp
inspect the sip
inspect xdmcp
!
global service-policy global_policy
context of prompt hostname
no remote anonymous reporting call
call-home
Profile of CiscoTAC-1
no active account
http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
email address of destination [email protected] / * /
destination-mode http transport
Subscribe to alert-group diagnosis
Subscribe to alert-group environment
Subscribe to alert-group monthly periodic inventory 26
Subscribe to alert-group configuration periodic monthly 26
daily periodic subscribe to alert-group telemetry
Cryptochecksum:aa675139dc84529791f9aaba46eb17f9
: end

I confess that I have not read your config in detail, but a few tips:

-If you do split tunnel, don't forget to push a route for the entire pool VPN subnet or subnets of VPN clients

-Make sure you have the same-security-traffic permitted intra-interface

http://www.Cisco.com/c/en/us/TD/docs/security/ASA/asa81/command/ref/refg...

-If you use NAT, you must exclude such NAT inter-VPN-device traffic

-If you have ACLs (not shown) do not forget to leave your pool VPN subnet is talking to himself. Generally, it would be in the ACL entering the external interface.

at the end of the packet - trace is your friend.

NGP

ASA - ldap - user vpn static address

Hello!

I am trying to configure ASA to assign a static IP even to some user (User1) every time when it connect to the network via the AnyConnect client. We have Windows AD and that you are using the LDAP AAA server for authentication of remote access VPN users. I found in the document 'Cisco ASA 5500 Series Configuration using the CLI, 8.2 Guide' in the explanation section "Configuring external year for security device user permission to the server" and configured the ASA and user properties in AD exectly similarly:

Firstly, I assigned a static ip address in the menu properties (section numbering) of User1 in Active Directory. Then I created the ldap attribute card where I traced msRADIUSFrameIPAddressattribute to IETF-RADIUS-Framed-IP-Address. attribute In the end, I applied this map to attribute ldap to LDAP AAA server group.

Although I have implemented this, whenever I connect using User1 received powers AD I always get the ip address of the vpn pool rather a static ip address which I configured. In the output of debugging ldap 255 command I found the line "msRADIUSFramedIPAddress: value =-1062718956 ' but not any line that prove the above attribute map.

It seems that the mapping does not work.

All AnyConnect users get the policy settings defined internal group on ASA, including addresses form pool, dns etc server. I want User1 to get a static IP and inherit all other group policy settings.

If someone has any ideas of how to fix this, please help.

Thank you

Hello

Please give the output of the aaa server hs.

I found the link that gives you the configuration of the requirement details.

http://www.Cisco.com/en/us/docs/security/ASA/asa82/configuration/guide/ref_extserver.html#wp1661694

I hope this helps.

Kind regards

Anisha

P.S.: Please mark this message as answered if you feel that your query is resolved. Note the useful messages.

LDAP AAA for VPN configuration

Preface: I'm all new to Cisco Configuration and learn as I go.

I'm at the stage of configuration LDAP to configure a VPN on ASA 5520, software release 8.3 (1). Previously the programme installation and RADIUS authentication successfully tested, I tried to use similar logic to implement the LDAP authentication/authorization. I have acquired a service account that queries the pub for the identification of the registered user information. My main resource was the following Manual: Cisco ASA 5500 Series Configuration Guide using the CLI Software Version 8.3. I did initially configurations by using ASDM, but could not get tests to succeed. So I amazed the ASDM configs and went to the CLI. Here is the configuration.

AAA-server AAA_LDAP protocol ldap
AAA-server host 10,20,30,40 (inside) AAA_LDAP
Server-port 636
LDAP-base-dn domain.ad
LDAP-scope subtree
LDAP-naming-attribute uid
LDAP-login-password 8 *.
LDAP-connection-dn cn = commonname, OU = ou01, or = ou02, dc = domain, dc = ad
enable LDAP over ssl
microsoft server type
LDAP-attribute-map LDAP_ATTRIB

---

type tunnel-group ASA_DEFAULT remote access
attributes global-tunnel-group ASA_DEFAULT
authorization-server-group AAA_LDAP

---

LDAP attribute-map LDAP_ATTRIB
name of the MemberOf IETF Radius-class card
map-value MemberOf "VPN users' asa_default

---

I tested all the naming-attribute ldap alternatives listed with the same results.

When I test the authentication using this configuration, I get the following error: ERROR: authentication server does not: AAA Server has been deleted

When I test authorization using this Setup, I get the same error (except for the word permission instead of authentication).

I am at a total loss. Any help would be appreciated.

I would use ldp.exe to see if you can make sure that the sytnax of your ldap-connection-dn is just as you have in your config, it really helps just copy and paste.

The problem I see is the following:

[210] link as st_domadm
[210] authentication Simple running to st_domadm to 10.20.30.30
[210] simple authentication for st_domadm returned credenti invalid code (49) als
[210] impossible to link the administrator returned code-(1) can't contact LDAP er

I suppose your ldap-connection-dn is st_domadm and you try to test with the administrator account?

Thank you

Tarik

After Anyconnect I can't access to asa and LAN

Dear all,

My office use ASA 5505 and I use anyconnect from outside (sometimes overseas), I can connect to my network and business by ASA, internet access, but I can't access ASA and LAN (network of my client). WHY?

Office 192.168.10.0/24

192.168.11.0/24 VPN

How can I solve this problem?

ASA Version 9.2 (3)
!
ciscoasa hostname
activate the encrypted password of XXXXXXXXXX
volatile xlate deny tcp any4 any4
volatile xlate deny tcp any4 any6
volatile xlate deny tcp any6 any4
volatile xlate deny tcp any6 any6
volatile xlate deny udp any4 any4 eq field
volatile xlate deny udp any4 any6 eq field
volatile xlate deny udp any6 any4 eq field
volatile xlate deny udp any6 any6 eq field
passwd encrypted XXXXXXXXXX
names of
192.168.11.1 mask - 192.168.11.10 local pool Pool VPN IP 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 100
IP address 192.168.10.254 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
address IP AAA. BBB. CCC DDD EEE. FFF. GGG. HHH
!
boot system Disk0: / asa923 - k8.bin
passive FTP mode
clock timezone 8 HKST
DNS domain-lookup outside
DNS server-group DefaultDNS
Name-Server 8.8.8.8
Server name 8.8.4.4
permit same-security-traffic intra-interface
network of the VPN_Pool object
subnet 192.168.11.0 255.255.255.240
network of the NETWORK_OBJ_192.168.10.0_24 object
192.168.10.0 subnet 255.255.255.0
inside_access_in of access allowed any ip an extended list
outside_access_in list extended access permit icmp any one
DefaultRAGroup_splitTunnelAcl_1 list standard access allowed 192.168.10.0 255.255.255.0
pager lines 24
Enable logging
asdm of logging of information
Within 1500 MTU
Outside 1500 MTU
ICMP unreachable rate-limit 1 burst-size 1
ASDM image disk0: / asdm-731 - 101.bin
don't allow no asdm history
ARP timeout 14400
no permit-nonconnected arp
interface NAT (outside, outside) dynamic source VPN_Pool
NAT (inside, outside) static source any any static destination VPN_Pool VPN_Pool non-proxy-arp-search to itinerary
!
!
NAT source auto after (indoor, outdoor) dynamic one interface
inside_access_in access to the interface inside group
Access-group outside_access_in in interface outside
Route outside 0.0.0.0 0.0.0.0 AAA. BBB. CCC DDD. 1
Timeout xlate 03:00
Pat-xlate timeout 0:00:30
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
dynamic-access-policy-registration DfltAccessPolicy
identity of the user by default-domain LOCAL
Activate Server http XXXXX
http 192.168.10.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
Crypto ipsec ikev2 ipsec-proposal OF
encryption protocol esp
Esp integrity sha - 1, md5 Protocol
Crypto ipsec ikev2 proposal ipsec 3DES
Esp 3des encryption protocol
Esp integrity sha - 1, md5 Protocol
Crypto ipsec ikev2 ipsec-proposal AES
Esp aes encryption protocol
Esp integrity sha - 1, md5 Protocol
Crypto ipsec ikev2 ipsec-proposal AES192
Protocol esp encryption aes-192
Esp integrity sha - 1, md5 Protocol
Crypto ipsec ikev2 AES256 ipsec-proposal
Protocol esp encryption aes-256
Esp integrity sha - 1, md5 Protocol
Crypto ipsec pmtu aging infinite - the security association
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set
Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-192-SHA ESP-AES-256-SHA SHA-ESP-3DES ESP-DES-SHA ESP-AES-128-SHA-TRANS ESP-AES-192-SHA-TRANS ESP-AES-256-SHA-ESP ESP-3DES-SHA-TRANS TRANS-DES-SHA-TRANS
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
outside_map interface card crypto outside
Crypto ca trustpoint ASDM_TrustPoint0
Terminal registration
name of the object CN = ciscoasa
Configure CRL
Crypto ca trustpoint Anyconnect_Self_Signed_Cert
registration auto
name of the object CN = ciscoasa
Configure CRL
Crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0
registration auto
name of the object CN = 115.160.145.114, CN = ciscoasa
Configure CRL
trustpool crypto ca policy
string encryption ca Anyconnect_Self_Signed_Cert certificates
certificate 5c7d4156
308202d 4 308201bc a0030201 0202045c 415630 0d06092a 864886f7 0d 010105 7 d
0500302c 3111300f 06035504 03130863 6973636f 61736131 17301506 092a 8648
09021608 63697363 6f617361 31353131 31303131 31363231 301e170d 86f70d01
5a170d32 35313130 37313131 3632315a 302 c 3111 55040313 08636973 300f0603
636f6173 61311730 1506092a 864886f7 0d 010902 16086369 73636f61 73613082
0122300d 06092 has 86 01010105 00038201 0f003082 010a 0282 010100cc 4886f70d
af43a895 8c2c3f49 ad16c4b9 a855b47b 773f4245 1954c 728 7 c 568245 6ddc02ab
78 c 45473 eb4073f6 401d1dca 050dc53f cfb93f58 68087f6d 03334fc 1 53f41daa
454ff4bb 691235ab 34e21d98 4cfecef4 204e9c95 76b1b417 b5cf746c 830788b 4
60063e89 0ffe5381 42694cf8 d1be20d4 4c95d9c6 93041af2 94783de0 fe93cf67
4ad8954f 5392790b 4ded225c c3128cba 8d3ee07b f9fd2208 34b1956c be0a774a
d054a290 14316cc0 1670bdea f04c828b 7f9483fb 409fa707 fbe5a257 33597fed
ca790881 b1d4d3dc b0e1095e bf04014e 19c5cfeb f74aac57 ee39cd6e 7389cdd1
8b9421fa ee2b99ae df07fba1 0b506cd8 ea9f64c5 dd9169ad 157fcdb7 f6cfff02
03010001 300 d 0609 2a 864886 05050003 82010100 c8719770 1305bd9c f70d0101
2608f039 0dc6b058 0dfe3d88 76793 has 18 8f601dda b 8553, 893 d95e3b25 30ef7354
772f7d0b 772869d 7 372f8f5c f32992af fa2c8b6e 0f0ae4ce 4e068b8d b7916af2
affa1953 5bfd01a6 1a3c147d 75d95d8c 1122fa85 3905f27b 2474aff4 11fff24f
c305b648 b4c9d8d4 9dcf444b 9326cda3 0c4635d0 90ff8dd8 9444726c 82e002ec
be120937 0414c20a 39df72fb 76cd9c38 cde9afda 019e9230 66e5dba8 ed208eae
5faabb85 ff04f8f2 c36b724b 62ec52cc f967ee1d 1a6458fc 507a 2377 45 c 20635
2c14c431 baac678a dcc20329 4db7aa51 02c 36904 75b5f307 f1cc056d 726bc436
597a 3814 4ccd421d cb77d8f5 46a8ae69 2d617ac8 2160d7af
quit smoking
string encryption ca ASDM_Launcher_Access_TrustPoint_0 certificates
certificate 5d7d4156
308201f0 30820308 a0030201 0202045d 415630 0d06092a 864886f7 0d 010105 7 d
05003046 06035504 03130863 61736131 18301606 03550403 6973636f 3111300f
130f3131 352e3136 302e3134 352e3131 1506092a 34311730 864886f7 0d 010902
73636f61 16086369 7361301e 170d 0d 323531 3135 31313130 31323136 35395a 17
3111300f 06035504 03130863 6973636f 61736131 a 31303731 32313635 395, 3046
18301606 03550403 130f3131 352e3136 302e3134 352e3131 1506092's 34311730
864886f7 0d 010902 16086369 73636f61 73613082 0122300d 06092 has 86 4886f70d
01010105 00038201 0f003082 010 has 0282 010100cc af43a895 8c2c3f49 ad16c4b9
a855b47b 773f4245 1954c 728 7 c 78 45473 eb4073f6 401d1dca 568245 6ddc02ab
050dc53f cfb93f58 68087f6d 03334fc 1 53f41daa 454ff4bb 691235ab 34e21d98
b 830788 4 4cfecef4 204e9c95 76b1b417 b5cf746c 60063e89 0ffe5381 42694cf8
d1be20d4 4c95d9c6 93041af2 94783de0 fe93cf67 4ad8954f 5392790b 4ded225c
c3128cba 8d3ee07b f9fd2208 34b1956c be0a774a d054a290 14316cc0 1670bdea
f04c828b 7f9483fb 409fa707 fbe5a257 33597fed ca790881 b1d4d3dc b0e1095e
bf04014e 19c5cfeb f74aac57 ee39cd6e 7389cdd1 8b9421fa ee2b99ae df07fba1
0b506cd8 ea9f64c5 dd9169ad 157fcdb7 f6cfff02 03010001 300 d 0609 2a 864886
05050003 82010100 00089cd 3 d0f65c5e 91f7ee15 bbd98446 35639ef9 f70d0101
45b 64956 f146234c 472b52e6 f2647ced a109cb6b 52bf5f5d 92471cb7 a3a30b63
052ac212 c6027535 16e42908 ea37c39a 4d203be9 8c4ed8cd 40935057 3fe8a537
a837c75c feff4dcc 1b2fd276 257f0b46 8fcd2a5c cbdcacec cd14ee46 be136ae7
7cd4ae0d aace54fe 5187ea57 40d2af87 cded3085 27d6f5d8 1c15ef98 f95cc90e
a 485049 4 805efa8f 63406609 a663db53 06b94e53 07c1c808 61eadcdb 2c952bee
74a0b3dd ae262d84 40b85ec5 a89179b2 7e41648e 93f0e419 3c482b29 e482d344
d756d450 8f0d9302 d023ac43 a31469a4 105c8a0c b1418907 693c558c 08f499ef
364bc8ba 4543297a a17735a0
quit smoking
IKEv2 crypto policy 1
aes-256 encryption
integrity sha
Group 2 of 5
FRP sha
second life 86400
IKEv2 crypto policy 10
aes-192 encryption
integrity sha
Group 2 of 5
FRP sha
second life 86400
IKEv2 crypto policy 20
aes encryption
integrity sha
Group 2 of 5
FRP sha
second life 86400
IKEv2 crypto policy 30
3des encryption
integrity sha
Group 2 of 5
FRP sha
second life 86400
IKEv2 crypto policy 40
the Encryption
integrity sha
Group 2 of 5
FRP sha
second life 86400
Crypto ikev2 activate out of service the customer port 443
Crypto ikev2 access remote trustpoint Anyconnect_Self_Signed_Cert
Crypto ikev1 allow outside
IKEv1 crypto policy 10
authentication crack
aes-256 encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 20
authentication rsa - sig
aes-256 encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 30
preshared authentication
aes-256 encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 40
authentication crack
aes-192 encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 50
authentication rsa - sig
aes-192 encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 60
preshared authentication
aes-192 encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 70
authentication crack
aes encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 80
authentication rsa - sig
aes encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 90
preshared authentication
aes encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 100
authentication crack
3des encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 110
authentication rsa - sig
3des encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 120
preshared authentication
3des encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 130
authentication crack
the Encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 140
authentication rsa - sig
the Encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 150
preshared authentication
the Encryption
sha hash
Group 2
life 86400
Telnet timeout 5
SSH stricthostkeycheck
SSH timeout 5
SSH group dh-Group1-sha1 key exchange
Console timeout 0
No ipv6-vpn-addr-assign aaa
no local ipv6-vpn-addr-assign

dhcpd 192.168.10.254 dns 8.8.8.8
dhcpd rental 43200
!
dhcpd address 192.168.10.1 - 192.168.10.100 inside
dhcpd allow inside
!
a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
NTP AAA server. BBB. CCC. Source DDD outside prefer
SSL-point of approval ASDM_Launcher_Access_TrustPoint_0 outside vpnlb-ip
SSL-trust outside ASDM_Launcher_Access_TrustPoint_0 point
WebVPN
allow outside
AnyConnect image disk0:/anyconnect-win-4.2.00096-k9.pkg 1
AnyConnect profiles Anyconnect_client_profile disk0: / Anyconnect_client_profile.xml
AnyConnect enable
tunnel-group-list activate
internal DefaultRAGroup_2 group strategy
attributes of Group Policy DefaultRAGroup_2
DNS-server AAA value. BBB. CCC AAA DDD. BBB. CCC DDD.
Ikev2 VPN-tunnel-Protocol
Split-tunnel-policy tunnelspecified
internal GroupPolicy_Anyconnect group strategy
attributes of Group Policy GroupPolicy_Anyconnect
WINS server no
value of server DNS 8.8.8.8 8.8.4.4
Ikev1 VPN-tunnel-Protocol, l2tp ipsec ikev2 ssl-client
Split-tunnel-policy tunnelall
IPv6-split-tunnel-policy excludespecified
value of Split-tunnel-network-list DefaultRAGroup_splitTunnelAcl_1
by default no
activate dns split-tunnel-all
IPv6 address pools no
WebVPN
AnyConnect value Anyconnect_client_profile type user profiles
username password XXXXXXX XXXXXXXXXXXXXXX encrypted privilege 15
username password XXXXXXX XXXXXXXXXXXXXXX encrypted privilege 15
attributes of username XXXXXXX
Ikev1 VPN-tunnel-Protocol, l2tp ipsec ikev2 ssl-client
attributes global-tunnel-group DefaultRAGroup
address pool VPN-pool
Group Policy - by default-DefaultRAGroup_2
IPSec-attributes tunnel-group DefaultRAGroup
IKEv1 pre-shared key XXXXXXXXX
tunnel-group DefaultRAGroup ppp-attributes
ms-chap-v2 authentication
tunnel-group Anyconnect type remote access
tunnel-group Anyconnect General attributes
address pool VPN-pool
Group Policy - by default-GroupPolicy_Anyconnect
NAT - to-public-ip assigned inside
tunnel-group Anyconnect webvpn-attributes
enable Anyconnect group-alias
tunnel-group Anyconnect ppp-attributes
ms-chap-v2 authentication
!
Global class-card class
match default-inspection-traffic
!
!
World-Policy policy-map
Global category
inspect the dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the netbios
inspect the tftp
Review the ip options
!
service-policy-international policy global
context of prompt hostname
no remote anonymous reporting call
call-home
Profile of CiscoTAC-1
no active account
http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
email address of destination [email protected] / * /
destination-mode http transport
Subscribe to alert-group diagnosis
Subscribe to alert-group environment
Subscribe to alert-group monthly periodic inventory
monthly periodicals to subscribe to alert-group configuration
daily periodic subscribe to alert-group telemetry
Cryptochecksum:24991680b66624113beb31d230c593bb
: end

Hi cwhlaw2009,

You must configure a policy Split-tunnel, if you want to be able to access the internal and local network at the same time.

http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-next-generation-firewalls/100936-asa8x-split-tunnel-AnyConnect-config.html

It may be useful

-Randy-

How to map a dynamic access to a group policy strategy?

Experts,

I'm doing an SSL implementation and a part of the requirement is to have the authentication of users in LDAP, are mapped to a particular group policy. They need this mapping for a particular bookmark assigned to them, because they are strictly using the WEBVPN portal. I have several DAP is configured and I want to map the user that is matched for each DAP, to a particular group policy. I read you can use the LDAP attributes on the user account in AD, but I want to map the DAP "mortgage" in Group Policy "mortgage", as opposed to reading additional AD attributes of the user. Is this possible?

DAP and group policy are two ways to implement access control on the remote access vpn client.

DAP must take precedence over group strategy.

When the responses from the LDAP server for authentication request with the LDAP group member attribute, you can map this attribute of joining a DAP folder or a group policy.

If you want to map the LDAP group member attribute to group policy, you must set the attribute LDAP map. Please see the example below

http://www.Cisco.com/en/us/partner/products/ps6120/products_configuration_example09186a00808d1a7c.shtml

If you want to map the attribute for LDAP group membership in politics of the DAP, you will find the guide in ASDM

Edit-> Advanced-> Guide dynamic access policy.

The below is copied from the guide above.

Example of composition of group

You can create a basic logical expression for the special criteria of belonging to an AD Group. Because users can belong to several groups, DAP analyzes the response from the LDAP server in separate fields in a table. You need an advanced feature to accomplish the following:
- Compare the memberOf a string field (in which case the user belongs to a group).
- Iterate over each field returned memberOf if the data returned is of type "table".
The function that we have written and tested for this purpose is shown below. In this example, if a user is a member of a group, ending by "-stu" they correspond to the DAP.
```
assert(function()

       local pattern = "-stu$"

       local attribute = aaa.ldap.memberOf

       if ((type(attribute) == "string") and

           (string.find(attribute, pattern) ~= nil)) then

           return true

       elseif (type(attribute) == "table") then

           local k, v

           for k, v in pairs(attribute) do

               if (string.find(v, pattern) ~= nil) then

                   return true

               end

           end

       end

       return false

    end)()

    
```

Help with the easy VPN server with LDAP

Hello

I used to be able to set up our easy VPN server with local authentication.

But now, I'm trying to use LDAP authentication to match with our policies.

Can someone help me please to check the config and tell me what is wrong with him?

My router is a Cisco1941/K9.

Thank you in advance.

Ryan

Current configuration: 5128 bytes
!
! Last configuration change at 13:25:16 UTC Tuesday, August 28, 2012, by admin
! NVRAM config update at 05:03:14 UTC Monday, August 27, 2012, by admin
! NVRAM config update at 05:03:14 UTC Monday, August 27, 2012, by admin
version 15.2
horodateurs service debug datetime msec
Log service timestamps datetime msec
no password encryption service
!
router host name
!
boot-start-marker
boot-end-marker
!
!
!
AAA new-model
!
!
AAA group ASIA-LDAP ldap server
Server server1.domain.net
!
AAA authentication login ciscocp_vpn_xauth_ml_1 local
AAA authentication login ASIA-LDAP-AUTHENTIC ldap group ASIA-LDAP
local VPN_Cisco AAA authorization network
Group ldap AAA authorization network ASIA-LDAP-ASIA-LDAP group authorization
!
!
!
!
!
AAA - the id of the joint session
!
!
No ipv6 cef
!
!
!
!
!
IP domain name domaine.net
IP cef
!
Authenticated MultiLink bundle-name Panel
!
Crypto pki token removal timeout default 0
!
Crypto pki trustpoint TP-self-signed-765105936
enrollment selfsigned
name of the object cn = IOS - Self - signed - certificate - 765105936
revocation checking no
rsakeypair TP-self-signed-765105936
!
!
TP-self-signed-765105936 crypto pki certificate chain
certificate self-signed 01
30820229 30820192 A0030201 02020101 300 D 0609 2A 864886 F70D0101 05050030
2 060355 04031325 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 30312E30
69666963 37363531 30353933 36301E17 313230 36323630 39323033 0D 6174652D
355A170D 2E302C06 1325494F 03550403 32303031 30313030 30303030 5A 303031
532D 5365 6C662D53 69676E65 642D 4365 72746966 69636174 652 3736 35313035
06092A 86 4886F70D 01010105 39333630 819F300D 00308189 02818100 0003818D
C1B7E661 4893D83A EFE44B76 92BAA71A 6375 854 C 88 D 4533E51A 49791 551D8EF7
F82E2432 E65B401D 27FE4896 2105B38A CB1908C1 9AE2FC19 8A9393C3 1 B 618390
EE6CB1CC 5C8B8811 04FA198E 16F3297B 6B15F974 13EE4897 97270547 31 74270
4590ACA6 68606596 97C5D4D5 462CACA0 CDDAC35A 17415302 CFD4E329 8E7E542D
02030100 01A 35330 03551 D 13 51300F06 0101FF04 05300301 01FF301F 0603551D
23041830 1680142E FF686472 569BCCF1 552B 1200 1 060355 5B660F30 D35060DB
1D0E0416 04142EFF 9BCCF155 68647256 2B1200D3 5060DB5B 660F300D 06092 HAS 86
01010505 00038181 00558F64 05207 D 35 AA4BD086 4579ACF6 BCF6A851 4886F70D
1D0EA15B 75DBFA45 E01FBA5C 6F827C42 1A50DD11 8922F1E5 3384B8D8 8DD6C222
0187E501 82C1C557 8AD3445C A4450241 75D771CF 3A6428A6 7E1FC7E5 8B418E65
74D265DD 06251C7D 6EF39CE9 3 D FE03F795 692763 AE865885 CFF660A5 4C1FF603
3AF09B1E 243EA5ED 7E4C30B9 3A
quit smoking
license udi pid CISCO1941/K9 sn xxxxxxxxxxx

ISM HW-module 0
!
!
!
secret admin user name of privilege 15 5 $1 rVI4$ WIP5x6at0b1Vot5LbdlGN.
ryan privilege 0 0 pass1234 password username
!
redundancy
!
!
!
!
!
!
!
crypto ISAKMP policy 1
BA 3des
preshared authentication
Group 2
!
Configuration group customer isakmp crypto VPN_Group1
xxxxxxxxxxxx key
DNS 10.127.8.20
pool SDM_POOL_1
ACL 100
netmask 255.255.255.0
ISAKMP crypto ciscocp-ike-profile-1 profile
match of group identity VPN_Group1
authentication of LDAP-ASIA-AUTHENTIC customer list
whitelist ISAKMP ASIA-LDAP-authorization of THE
client configuration address respond
virtual-model 1
!
!
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
!
Profile of crypto ipsec CiscoCP_Profile1
game of transformation-ESP-3DES-SHA
set of isakmp - profile ciscocp-ike-profile-1
!
!
!
!
!
!
!
interface Loopback0
IP 10.127.15.1 255.255.255.0
!
the Embedded-Service-Engine0/0 interface
no ip address
Shutdown
!
interface GigabitEthernet0/0
IP xxx.xxx.xxx.xxx 255.255.255.224
automatic duplex
automatic speed
!
interface GigabitEthernet0/1
IP 10.127.31.26 255.255.255.252
automatic duplex
automatic speed
!
type of interface virtual-Template1 tunnel
IP unnumbered Loopback0
ipv4 ipsec tunnel mode
Tunnel CiscoCP_Profile1 ipsec protection profile
!
local IP SDM_POOL_1 10.127.20.129 pool 10.127.20.254
IP forward-Protocol ND
!
IP http server
local IP http authentication
IP http secure server
IP http timeout policy slowed down 60 life 86400 request 10000
!
IP route 0.0.0.0 0.0.0.0 GigabitEthernet0/0
IP route 10.0.0.0 255.0.0.0 10.127.31.25
IP route 10.127.20.128 255.255.255.128 GigabitEthernet0/0
!
Note access-list 100 category CCP_ACL = 4
access-list 100 permit ip 10.0.0.0 0.255.255.255 everything
!
!
!
!
!
!
!
LDAP attribute-map ASIA-username-map
user name of card type sAMAccountName
!
Server1.domain.NET LDAP server
IPv4 10.127.8.20
map attribute username-ASIA-map
bind authenticates root-dn CN = xxx\, S1234567, OU = Service accounts, OR = Admin, OU = Acc
DC = domain, DC = net password password1
base-dn DC = domain, DC = net
bind authentication-first
!
!
control plan
!
!
!
Line con 0
line to 0
line 2
no activation-character
No exec
preferred no transport
transport of entry all
output transport lat pad rlogin lapb - your MOP v120 udptn ssh telnet
StopBits 1
line 67
no activation-character
No exec
preferred no transport
transport of entry all
output transport lat pad rlogin lapb - your MOP v120 udptn ssh telnet
StopBits 1
line vty 0 4
transport telnet entry
!
Scheduler allocate 20000 1000
end

Router #.

Ryan,

It seems that you are facing the question where it is indicated in the section:

Problems with the help of "authentication bind first" with user-defined attribute maps:

* Then you are likely to see a failure in your authentication attempt. You will see the error message "Invalid credentials, result code = 49. The newspapers will look something like the journals below: *.

Which is the same error you see. Go ahead and replace in your attribute map and test again.

If you remove the command "bind-first authentication' configuration above, everything will work correctly.

https://supportforums.Cisco.com/docs/doc-17780

Tarik Admani
* Please note the useful messages *.

Attribute LDAP AnyConnect Map

Similar Questions

Example of composition of group

Maybe you are looking for