(LDAP) provider mapping alias

Similar Questions

• Creating a LDAP provider

  Hello

  When you configure UCS Manager 2.0 to authenticate from a vendor LDAP (Active Directory) I m somewhat unclear if the "Attribute" field is required or not when the LDAP provider is configured?

  According to the Configuration Guide 137 page, it is in the LDAP provider or in the general tab of the LDAP:

  http://www.Cisco.com/en/us/docs/unified_computing/UCS/SW/GUI/config/Guide/2.0/b_UCSM_GUI_Configuration_Guide_2_0.PDF

  While in other guides it is empty and seem to work very well:

  http://ucsguru.com/2012/06/26/Cisco-UCS-Active-Directory-integration/

  Can someone make the som light on that?

  Hi Andreas,

  If you use authentication based on attribute or AD Group members, then there is no place for an attribute. If you do not use the role of group mapping, then you must specify the AD attribute, passing the role to UCSM for the user.

  . / Afonso

• Attribute LDAP AnyConnect Map

  I'm trying to configure the attribute map for our SSL Anyconnect Client connections. Basically I want all connections to be deleted, unless the AD attribute numbering is set to allow users.

  I have it working. But according to the instructions of Cisco, you create a group policy for NoAccess as your default strategy for your connection profile and kinematics-connections set to 0. The idea being to all connections will be dropped unless they use a different group strategy. As soon as I change my strategy of group - by default-NoAccess, I can not connect.

  ldap attribute-map LDAPVPN
  
        map-name  msNPAllowDialin IETF-Radius-Class
  
        map-value msNPAllowDialin FALSE NOACCESS
  
        map-value msNPAllowDialin TRUE SSL-VPN
  
  aaa-server LDAP protocol ldap
  
      aaa-server LDAP (inside) host 192.200.202.5
  
      server-port 389
  
      ldap-base-dn dc=*****,dc=com
  
      ldap-scope subtree
  
      ldap-naming-attribute sAMAccountName
  
      ldap-login-password *****
  
      ldap-login-dn CN=cisco,OU=Service,OU=Accounts,OU=*****,DC=******,DC=com
  
      server-type microsoft
  
      ldap-attribute-map LDAPVPN
  group-policy SSL-VPN internal
  
      group-policy SSL-VPN attributes
  
      dns-server value 192.200.202.5 192.200.202.6
  
      vpn-tunnel-protocol svc
  
      split-tunnel-policy tunnelspecified
  
      split-tunnel-network-list value VPN-Tunnel
  
      group-policy NoAccess internal
  
      group-policy NoAccess attributes
  
      vpn-simultaneous-logins 0
  
      vpn-tunnel-protocol IPSec svc
  
      webvpn
  
        svc ask none default svc
  tunnel-group SSL-VPN type remote-access
  
      tunnel-group SSL-VPN general-attributes
  
      address-pool ssl-pool
  
      authentication-server-group LDAP
  
      default-group-policy NoAccess
  
      tunnel-group SSL-VPN webvpn-attributes
  
      group-alias ******* enable
  

   If I check debug you can see the attribute being mapped correctly. What gives?
  
      

  test aaa authorization LDAP host 192.200.202.5 username ****
  
  [333]   msNPAllowDialin: value = TRUE
  
      [333]           mapped to IETF-Radius-Class: value = SSL-VPN
  
      [333]           mapped to LDAP-Class: value = SSL-VPN
  
  
   
   
  			 
  Hello, please follow these steps:
  attributes of SSL - VPN group policy
  VPN - connections 3
  What is happening here is that the SSL - VPN group policy inherits the value 0 of concurrent vpn connections to NoAccess policy as soon as set you it uo as default group policy under the tunnel-group. That's why we need to specifically add value on SSL - VPN group policy.
  		   

• How to provide the Alias name for BOX Stmt?

  Hello

  How to provide the Alias name for the instruction BOX?

  --

  Thank you and best regards,

  Badr Hari

  1007980 wrote:

  Hello

  How to provide the Alias name for the instruction BOX?

  --

  Thank you best regards &,.

  Badr Hari

  You post any instructions BOX or a query.

  You just add an alias after him, as you do for any other column you select.

  Select case when deptno = 20, then 'Yes' else 'no' from the end IsItDept20 dept

  ISITDEPT20

  NO.

  Yes

  NO.

  NO.

• ACS 4.2 RSA Authentication and LDAP group mapping

  Hello

  I have a firewall, PaloAlto, with overall protection enabled (SSL - VPN) feature

  I use Cisco Secure ACS as a proxy for the RSA SecurID authentication.

  After authentication is try to map ad through LDAP query groups.

  The question I've found, is that the user I get with user authentication has no field:

  Show user ip-user-mapping all | mbm60380 game

  10.240.1.24 vsys1 UIA 2388 2388 domain\mbm60380

  10.240.1.1 vsys1 UIA 2101 2101 domain\mbm60380

  10.240.250.1 mbm60380 2590859 2590859 vsys2 GP

  But the list of users that I receive from the LDAP query includes the domain prefix:

  See the user group name domain\group1 property

  short name: domain\group1

  [1] domain\aag60368

  [2] domain\ced61081

  [3] domain\jas61669

  [4] domain\mbm60380

  [5] domain\pmc61693

  [6] domain\vcm60984

  I would like to create the user with the area of GBA but it must delete the domain before querying the RSA server, as it does not support field stripping.

  I tried to fix this on the Palo Alto firewall without success.

  I'm trying to run Cisco Secure ACS 4.2 changing, but it did not work either:

  RSA servers are configured as an external database.  They are not defined in the groups of network devices.

  Can I set up domain stripping for queries servers RSA?

  Thank you

  Hello

  I think it should work, but it is a bit awkward:

  Create an entry in the Distribution of Proxy in the Network Configuration.

  DOMAIN\\USER *.

  Prefix

  Before returning to the AAA server, from there to authenticate to the server RSA without the domain prefix.

  Make sense?

  Thank you

  Chris

• VCAC6 error: could not retrieve upnSuffixes in AD on Ldap provider

  Hello

  I had sent a new VCAC 6.0.1 environment and I get a lot of error to /var/log/vmware/sso/vmware-sts-idmd.log who speaks of "Impossible to extract the upnSuffixes in Ldap AD Over provider."

  [2014-08-01 16:09, 453 05180a84-03a1-4771-9c80-148a8cbe3c6d demo ERROR] [LdapWithAdMappingsProvider] Failed to retrieve the upnSuffixes in demo.test.local provider Ldap AD Over

  java.security.InvalidParameterException: Null or empty values

  at com.vmware.identity.idm.server.provider.BaseLdapProvider.getStringValues(BaseLdapProvider.java:238)

  at com.vmware.identity.idm.server.provider.ldap.LdapWithAdMappingsProvider.getAlterUpnSuffixes(LdapWithAdMappingsProvider.java:233)

  at com.vmware.identity.idm.server.provider.ldap.LdapWithAdMappingsProvider.getRegisteredUpnSuffixes(LdapWithAdMappingsProvider.java:283)

  at com.vmware.identity.idm.server.provider.BaseLdapProvider.normalizeAliasInPrincipal(BaseLdapProvider.java:363)

  at com.vmware.identity.idm.server.provider.ldap.LdapWithAdMappingsProvider.authenticate(LdapWithAdMappingsProvider.java:304)

  at com.vmware.identity.idm.server.IdentityManager.authenticate(IdentityManager.java:2420)

  at com.vmware.identity.idm.server.IdentityManager.authenticate(IdentityManager.java:7907)

  at sun.reflect.GeneratedMethodAccessor91.invoke (unknown Source)

  at sun.reflect.DelegatingMethodAccessorImpl.invoke (unknown Source)

  at java.lang.reflect.Method.invoke (unknown Source)

  at sun.rmi.server.UnicastServerRef.dispatch (unknown Source)

  to sun.rmi.transport.Transport$ 1.run (unknown Source)

  to sun.rmi.transport.Transport$ 1.run (unknown Source)

  at java.security.AccessController.doPrivileged (Native Method)

  at sun.rmi.transport.Transport.serviceCall (unknown Source)

  at sun.rmi.transport.tcp.TCPTransport.handleMessages (unknown Source)

  to sun.rmi.transport.tcp.TCPTransport$ ConnectionHandler.run0 (unknown Source)

  to sun.rmi.transport.tcp.TCPTransport$ ConnectionHandler.run (unknown Source)

  at java.util.concurrent.ThreadPoolExecutor.runWorker (unknown Source)

  to java.util.concurrent.ThreadPoolExecutor$ Worker.run (unknown Source)

  at java.lang.Thread.run (unknown Source)

  I don't know is this a normal behavior? I have no doubt but I wanted to know, otherwise what would probably get bad around here...

  Thanks in advance!

  BR,

  MG

  I could solve the problem by changing the Port for LDAP 389 to Global Catalog Port 3268. This error was to come with the child trusted user in the main domain member. Since I changed the GC port, I'm no more have these errors.

  Thank you

  BR,

  MG

• i AM TRYING to PRINT MY OWN CARDS BY SCANNING PREVIOUSLY PROVIDED MAPS that HAVE INFORMATION on the TWO SIDES OF CARD

  One side of the map has details name and the coordinates of the other side has a start card

  Scan on each side, then save it in a separate file.  Download the paper business card.  Open the scanned images in a program that can read and print files (such as Microsoft Word or if you don't have that, try to download the free OpenOffice atwww.openoffice.org and you have use Writer).  Select the appropriate model for business cards.  Copy the image to the image of the screen of the model of card - making sure to add a copy of the image at each of the locations on the model of card.  Print it.  Then determine how the printer prints (which side must be in direction of printing that you want - and insert copies printed in the wastebasket as required - run a few tests with normal paper first so that you get the correct positioning).  Now select the other image and which print on the back of the copies which have only the first printed side.  Your cards are now printed.

  I hope this helps.

  Good luck!

  Lorien - MCSA/MCSE/network + / has + - if this post solves your problem, please click the 'Mark as answer' or 'Useful' button at the top of this message. Marking a post as answer, or relatively useful, you help others find the answer more quickly.

• URL and directory mapping/alias - frame functionality

  Hello... I wasn't sure of the best way to describe this, so here's my scenario. Is this possible... I know it's done with frameworks such as fuses. Trying to get an idea of how it could be done with the standard code of the CF.
  
  Types of user in the url: mysite.com/countryfolder/page.cfm.
  I would like the page to be served from mysite.com/international/countryfolder/page.cfm (D:\inetpub\wwwroot\etc...)
  
  Thanks in advance.

  After further research, I decided that it would be a stupid thing to do, therefore no need to reply (not that everyone has anyway).

• mapping of LDAP

  Hello
  I have to integrate Complutense University of Madrid with a ldap user repository. As a general question, each user must be mapped or can I "omit" one / some (I have a user that I want to keep all the features but I don't want to have access to the portal, so I'm thinknig of mapping simply do not hollow ldap). Is this possible or all Content Server users must have a sign with in the ldap repository, otherwise, he wants to work?
  We are talnking on a 10gR 3 content on an AIX5 server. On the repository of the user, I know a lot of things right now, but it was just a general question.
  
  Kind regards
  Maria

  HI Maria,

  As a general rule, you don't really need to map users to the University Complutense of MADRID to LDAP users. All you have to do is map (accounts and roles if you use the option accounts.)
  You must create users at all at the Complutense University of MADRID. You can configure the content server to authenticate a user directly from LDAP.
  In addition, a good thing is that AAU will allow each LDAP user who is trying to connect to the content server. Only the LDAP users that meet certain criteria, (i.e. LDAP roles that correspond to the roles of the AAU are affected) will be authorized successfully.

  All you have to do is to configure an LDAP provider. (You can even have more than one LDAP provider, so you can connect to more than one LDAP source)

  Kind regards
  Elvis

  Published by: Spada E on April 14, 2009 02:24

• LDAP on SAA with the attribute-map

  Hi all

  I have problems to set up authentication of VPN clients on a LDAP server.  The main problem is when the ASA needs to decide a strategy group for users of the non-compliance.

  I use the LDAP attribute cards in the SAA to map the parameter memberOf attribute group Cisco-policy, can I associate the ad group that the user must belong to a VPN and rigth memberOf Group Policy access.  This method works correctly.

  But the problem is when the remote user is not in the correct group AD, I put a group by default-policy - do not have access to this type of users.  After that, all users (authorized and unauthorized) fall into the same default - group policy do not have VPN access.

  There are the ASA configuration:

  LDAP LDAP attribute-map
  name of the memberOf Group Policy map
  map-value memberOf "cn = ASA_VPN, ou = ASA_VPN, OU = my group, dc = xxx, dc is com" RemoteAccess

  AAA-Server LDAP protocol ldap
  AAA-Server LDAP (inside) host 10.0.0.3
  or base LDAP-dn = "My group", dc = xxx, dc is com
  LDAP-scope subtree
  LDAP-naming-attribute sAMAccountName
  LDAP-login-password *.
  LDAP-connection-dn cn = users, ou = "My group", dc = xxx, dc = com
  microsoft server type
  LDAP-attribute-map LDAP

  internal group NOACCESS strategy
  NOACCESS group policy attributes
  VPN - concurrent connections 0

  internal RemoteAccess group strategy
  Group Policy attributes RemoteAccess
  value of server DNS 10.0.0.3
  Protocol-tunnel-VPN IPSec
  field default value xxx.com

  tunnel-group RemoteAccess type remote access
  attributes global-tunnel-group RemoteAccess
  address-pool
  LDAP authentication group-server
  NOACCESS by default-group-policy
  tunnel-group ipsec-attributes RemoteAccess
  pre-shared key *.

  As you can see, I followed all of the examples available on the web site to solve the problem, but I can't get a good result.

  Does anyone have a solution for this problem?

  Kind regards

  Guzmán

  Guzman,

  It should work without a doubt, that is the part to refuse already works well and the user who has the correct memberOf attribute should certainly are mapped to Allow access policy and should therefore be allowed in.

  I think that's a bug as well, but I had a quick glance and see nothing correspondent, and if it was a bug in 8.2.3. so I'm not expecting you to be the first customer to discover this, so I'm still more inclined to think that it's something in the config that we neglect (I know frome experience typo can sometimes be very difficult to spot).

  Could you get "debug aaa 255 Commons", so please, maybe that will tell us something.

  BTW, just to be sure: you don't don't have anything (such as vpn - connections) configured in the DfltGrpPolicy, did you? Just double check since your access policy Allow would inherit that.

  Maybe another test, explicitly configure a nonzero value for this parameter in the policy allow access, i.e.

  Group Policy allow access attrib

  VPN - 10 concurrent connections

  Herbert

• Clientless VPN SSL - policy of another LDAP authentication group

  Hi all

  I am currently working with Clientless SSL VPN. I have a problem with the creation of access to the different or blocking of users.

  I created tunnel/connection-profile (WEB-VPN-TEST-Profil2) and create group WEB-VPN-TEST2. I joined with the LDAP server. I also create a map LDAP attribute to provide only specific users to access. I havn't create an address pool

  What I'm trying to do is give access to the 'IL DBA' team and stop access to all the others in my organization. But to the login page when I give my password, I am able to connected even if I'm in the team "IT Network". Here's what I've done, (think I work for abcxyz.com)

  =======================================================

  AAA-server BL_AD protocol ldap

  AAA-server BL_AD (inside) host 172.16.1.1

  OR base LDAP-dn = abcxyz, DC = abcxyz, DC = com

  LDAP-naming-attribute sAMAccountName

  LDAP-login-password *.

  LDAP-connection-dn [email protected] / * /

  microsoft server type

  LDAP-attribute-map CL-SSL-ATT-map

  =======================================================

  LDAP attribute-map CL-SSL-ATT-map

  name of the memberOf IETF-Radius-class card

  map-value memberOf 'CN = IT s/n, OU = abcxyz, DC = abcxyz, DC = com' WEB-VPN-TEST2

  ========================================================

  WebVPN

  allow inside

  tunnel-group-list activate

  internal-password enable

  ========================================================

  internal strategy group WEB-VPN-TEST2

  Group WEB-VPN-TEST2 policy attributes

  VPN-tunnel-Protocol webvpn

  group-lock value WEB-VPN-TEST-Profil2

  WebVPN

  value of the URL-list WEB-VPN-TEST-BOOKMARK

  value of personalization WEB-VPN-TEST2

  ========================================================

  remote access of tunnel-group WEB-VPN-TEST-Profil2 type

  attributes global-tunnel-group WEB-VPN-TEST-Profil2

  authentication-server-group abcxyz_AD

  Group Policy - by default-WEB-VPN-TEST2

  tunnel-group WEB-VPN-TEST-Profil2 webvpn-attributes

  enable WEB-VPN-TEST-Profil2 group-alias

  =========================================================

  Please let me know if there is a question or let me know why I am still able to access the same if I did my attribure to match only with "IT"DBA ".

  Thanks in advance.

  BR.

  Adnan

  Hello Adnan,

  That's what you do:

  internal group WITHOUT ACCESS strategy

  attributes of non-group policy

  VPN - concurrent connections 0

  attributes global-tunnel-group WEB-VPN-TEST-Profil2

  Group Policy - by default-NO-ACCESS

  Group WEB-VPN-TEST2 policy attributes

  VPN - connections 3

  Kind regards

• ASA 9.0.2 - LDAP, MS AD, ldap-base-dn CN problem

  Hello

  I configured the LDAP on ASA authentication for VPN users. In MS AD, I have a group called 'VPN_Users' but this is CN.

  LDAP-base-dn CN = VPN_Users, OR = users, DC = company, DC = local

  The path identified in AD shows:

  DN: CN = VPN_Users, OR = users, DC = company, DC = local

  I want to allow only the users who are in the group mentioned. But it does not work. It seems that '' CN = VPN_Users '' is not one recognized as a group but it is.

  Any idea? or experience? Its IOS bug or what.

  Thank you.

  HI Matus,

  This is what you need.

  Configuration to limit access to a particular group of windows on AD

  LDAP LDAP of attribute-map-MAP

  name of the memberOf IETF-Radius-class card

  map-value memberOf CN = VPN_Users, OR = users, DC = company, DC = local

  !

  ! --- Name of group policy should be the group policy that you have configured on ASA-

  !

  AAA-Server LDAP-AD ldap Protocol

  AAA-Server LDAP-AD

  Server-port 389

  LDAP-base-dn DC = company, DC = local

  LDAP-scope subtree

  LDAP-naming-attribute sAMAccountName

  LDAP-connection-dn

  LDAP-login-password

  microsoft server type

  LDAP-attribute-map LDAP-map

  !

  !

  Group Policy internal

  attributes of group policy

  VPN - connections 3

  Protocol-tunnel-VPN IPSec l2tp ipsec...

  value of address pools

  !

  !

  internal group noaccess strategy

  attributes of the strategy group noaccess

  VPN - connections 1

  address pools no

  !

  !

  type of tunnel-group-remote access

  global-tunnel-group attributes

  Group-AD-LDAP authentication server

  NoAccess by default-group-policy

  Just in case, it does not work for you. Get the following information:

  Turn on the 'debugging ldap 255' group on the SAA and to connect with a user account that belongs to the Users of VPN

  1.] show run ldap

  2.] show aaa Server

  3.] see the tunnel-group race

  4.] show run Group Policy

  OR

  You can provide SH RUN of the SAA.

  Jatin kone
  -Does the rate of useful messages

• UCS Manager 2.2 - LDAP authentication

  Hello

  I have some general questions about authentication LDAP and UCS Manager.

  I hope it's unterstandable...

  We have the following structure:

  • DC = Company.domain.com
    • OU = Domain Administration
      • OU =Administrators
        • UO = Germany
          • CN = User1-SMA
          • CN = SMA-user2
      • OU = Test-UO
        • CN = ucstestuser
        • CN = ucsadmingroup--> Member = SMA-user1, user2-SMA
          

  I added an LDAP provider

  binduser is the SMA-User1

  Base DN = OU = Domain Administration, DC = company, DC = domain, DC = com

  attribute = empty

  filter = sAMAccountName = $userid

  password for User1 SMA

  group permission / recursive enabled.

  I have not add some attributes or map the group. Now I can connect with ucstestuser (read-only), but not with SMA-user1 user2 SMA oder.

  If I add ucstestuser to ucsadmingroup a map of this group, ucstestuser can access and have right to admin, ADM-user1 and user2-adm cannot access (user authentication failed).

  I don't understand, why ucstestuser can access and other users in a different OU not. Unique database name is domain Administration, so that UCSM should see all three users, not?

  Can anyone help? Thank you.

  / Danny

  With UCS remote authentication when a user connects using a temporary account on the FI as a UCS-MyAuthDomain\myusername, which is limited to a total of 32 characters.  If you shorten the name of domain authentication defined in UCSM domain.com to a shorter name as AD, it will allow for the use of a username any longer.

  Note

  For systems using the remote authentication protocol, the authentication domain name is considered to be part of the user name and the limit of 32 characters for usernames created locally. Because Cisco UCS inserts 5-character formatting, the authentication will fail if the name and the user character domain name combined total is greater than 27.

  http://www.Cisco.com/c/en/us/TD/docs/unified_computing/UCS/SW/GUI/config/Guide/2-2/b_UCSM_GUI_Configuration_Guide_2_2/b_UCSM_GUI_Configuration_Guide_2_1_chapter_01000.html

• CIsco Anyconnect VPN with LDAP AAA

  Hi there, I was hoping that someone can point me in the right direction here. I created a VPN connection profile to match anyconnect SSL entering customers. I would like to use LDAP group membership as a sine qua non for authentication. I found a few online pages on what to do about it, I followed. Unfortunately, it seems my connection profile to allow access to any user in the ldap, not only those of the ldap group database. I'll post the relevant bits of the config here in hopes that someone can point my mistake!

  The idea of the config is to have the map of connections 2 by default a noaccess policy which has 0 simultaneous connections and the profile card (SSL_VPN) connection ssl to anyconnect to group_policy_SSL_VPN group policy.

  local pool CONTOSOVICVPN_DHCP_POOL 10.0.5.51 - 10.0.5.254 255.255.255.0 IP mask

  NAT (inside_int, any) static source NetworkGroup_Internal_networks NetworkGroup_Internal_networks Network_VPNRANGE_10.0.5.0 Network_VPNRANGE_10.0.5.0 non-proxy-arp-search of route static destination

  LDAP attribute-map AuthUsers
  name of the memberOf Group Policy map
  map-value memberOf memberOf CN = NETWORK_CONTOSO_ASA_VPN_DLSG, OR = network, OU = resources, OU = CONTOSO, OU = security, OU = Groups, DC = CONTOSO, DC = group

  ynamic-access-policy-registration DfltAccessPolicy

  AAA-server CONTOSOVIC_LDAP protocol ldap
  AAA-server CONTOSOVIC_LDAP (inside_int) 10.0.0.45
  LDAP-base-dn DC = CONTOSO, DC = group
  LDAP-group-base-dn DC = CONTOSO, DC = group
  LDAP-scope subtree
  LDAP-naming-attribute sAMAccountName
  LDAP-login-password *.
  LDAP-connection-dn CN = ASA_LDAP_USER, OU = network, OU = accounts, DC = CONTOSO, DC = group
  microsoft server type

  No vpn-addr-assign aaa
  No dhcp vpn-addr-assign

  SSL-trust ASDM_TrustPoint4 outside_int point
  WebVPN
  Select outside_int
  AnyConnect essentials
  AnyConnect image disk0:/anyconnect-win-2.4.1012-k9.pkg 1
  AnyConnect enable
  tunnel-group-list activate
  internal NoAccess group strategy
  Group Policy attributes NoAccess
  WINS server no
  VPN - concurrent connections 0
  Ikev1 VPN-tunnel-Protocol, l2tp ipsec ikev2 ssl-client
  value by default-field CONTOSO.group
  disable the split-tunnel-all dns
  attributes of Group Policy DfltGrpPolicy
  VPN - concurrent connections 0
  client ssl-VPN-tunnel-Protocol ikev1 l2tp ipsec
  internal GroupPolicy_SSL_VPN group strategy
  attributes of Group Policy GroupPolicy_SSL_VPN
  WINS server no
  value of server DNS 10.0.0.45
  VPN - connections 1
  Ikev1 VPN-tunnel-Protocol, l2tp ipsec ikev2 ssl-client
  value of group-lock SSL_VPN
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list VPN_SPLIT_TUNNEL
  value by default-field CONTOSO.group
  activate dns split-tunnel-all
  the address value CONTOSOVICVPN_DHCP_POOL pools

  attributes global-tunnel-group DefaultRAGroup
  authorization-server-group CONTOSOVIC_LDAP
  NoAccess by default-group-policy
  authorization required
  tunnel-group DefaultRAGroup webvpn-attributes
  message of rejection-RADIUS-
  attributes global-tunnel-group DefaultWEBVPNGroup
  NoAccess by default-group-policy
  type tunnel-group SSL_VPN remote access
  attributes global-tunnel-group SSL_VPN
  address CONTOSOVICVPN_DHCP_POOL pool
  authentication-server-group CONTOSOVIC_LDAP
  authorization-server-group CONTOSOVIC_LDAP
  Group Policy - by default-GroupPolicy_SSL_VPN
  authorization required
  tunnel-group SSL_VPN webvpn-attributes
  message of rejection-RADIUS-
  Proxy-auth sdi
  enable CONTOSOvicvpn.CONTOSOgroup.com.au group-alias

  You must specify the NoAccess group policy as group policy by default for the Group of the SSL_VPN tunnel.

  Remember to rate helpful answers. :)

• Mapping attribute shall not take any effect on

  Greetings everyone.

  I'm in the throes of my 5520 configuration to provide different group policies based on LDAP group membership. I find that no matter what I do, only the default group is applied. I'm sure it'll be a simple fix - but I can't see it. I pasted the relevant parts of the configuration below.

  Any help would be much appreciated.

  Kind regards

  Rob

  name of the memberOf IETF-Radius-class card

  map-value memberOf "CN = VPN_IT, OU = groups of VPN, OR = remote accounts, OU = *, DC = *, DC = org ' NoAccess

  map-value memberOf "CN = VPN_Users, OU = groups of VPN, OR = remote accounts, OU = *, DC = *, DC = org ' users

  AAA-Server LDAP protocol ldap

  AAA-Server LDAP (Inisde) host 192.168.xxx.x

  Server-port 636

  LDAP-base-dn DC = *, DC = org

  LDAP-scope subtree

  LDAP-naming-attribute sAMAccountName

  LDAP-login-password *.

  LDAP-connection-dn CN = *, OU = Service accounts, DC = *, DC = org

  enable LDAP over ssl

  microsoft server type

  internal NoAccess group strategy

  Group Policy attributes NoAccess

  VPN - concurrent connections 0

  VPN-tunnel-Protocol svc

  WebVPN

  SVC request no svc default

  attributes of Group Policy DfltGrpPolicy

  VPN-idle-timeout no

  Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn

  the address value vpnpool168 pools

  WebVPN

  SVC request enable

  strategy of internal users group

  attributes of users group strategy

  value of server WINS 192.168.155.4 172.16.155.4

  value of 192.168.155.4 DNS server 172.16.155.4

  VPN - 200 concurrent connections

  VPN-tunnel-Protocol svc

  clientvpn.UK.naafi.org value by default-field

  Split-dns value naafi.org naafi.co.uk

  WebVPN

  SVC value vpngina modules

  SVC request no svc default

  attributes global-tunnel-group DefaultWEBVPNGroup

  address vpnpool168 pool

  Group-LDAP LOCAL authentication server

  NoAccess by default-group-policy

  I don't see an LDAP map attribute assigned to your LDAP AAA configuration.

  Within your 'aaa-Server LDAP' configuration section, you should have:

  LDAP-attribute-map