Scribd
Upload
11 views7 pages

SIMOS 4010 SSL VPN RADIUS Authorization v001

Uploaded by

minhlilili
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
11 views7 pages

SIMOS 4010 SSL VPN RADIUS Authorization v001

Uploaded by

minhlilili
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 7

CCNP Security – SIMOS

ASA SSL VPN RADIUS Authorization


SSL VPN Authorization Options
» Using local authorization through configured
group-policies
• Is not scalable, if you have multiple VPN gateways
• However, not all authorization options locally available on the
ASA may be available through remote-servers
» Solution is to use external servers for authorization
• LDAP/Active Directory
• RADIUS (Cisco ISE, Cisco ACS)
• ISE/ACS can be further integrated with Active Directory

Copyright © www.ine.com
SSL VPN Authorization via RADIUS
» Authorization options
• Receive from RADIUS the name of the locally
configured group-policy on the ASA
• Standard IETF RADIUS attribute 25 - Class attribute
• Receive from RADIUS directly the authorization
attributes, like the web access-list or vpn-filter
• RADIUS VSA (Vendor Specific attributes) - Cisco AV pairs

Copyright © www.ine.com
SSL VPN Authorization via RADIUS
» Cisco AV pairs for web access-list is used in
clientless SSL VPN
• webvpn:inacl#1=
• webvpn:inacl#2=
» Cisco AV pairs for vpn-filter (access-list) is
used in client-based VPN (SSL/IKEv2)
• ip:inacl#1=
• ip:inacl#2=

Copyright © www.ine.com
ASA Configuration Steps
» Integrate ASA with remote AAA server
• We’ll be using RADIUS (ISE server)
» Under the tunnel-group/connection-profile
• Bind the AAA server for both authentication and
authorization

Copyright © www.ine.com
ISE Configuration Steps
» Configure username in local database of ISE
» Configure authentication profile
• Bind it to a authentication policy
» Configure authorization profile
• Bind it to a authorization policy
» Configure authentication/authorization policies
Copyright © www.ine.com
Q&A

Copyright © www.ine.com All rights reserved.

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy