Cisco ASA Firewall: LDAP Users in a Specific Group Policy through clientless SSL VPN connection

Today I am going to talk about the LDAP users in the specific group policy where user is connecting through the clientless SSL VPN connection. First of all we need to understand the exact meaning of the LDAP, LDAP stands for Lightweight Directory Access Protocol. 

So LADP is a protocol used to admittance and attain directory data. It scans and manages directories over IP networks and works traditional over TCP/IP using simple string outlines for data delivery. So you can maintain the user directory information of your organization through LDAP. LDAP authentication can be called as authenticating user using LDAP server such as active directory.

Fig 1.1-LDAP User mapped with Cisco ASA Firewall
To place an LDAP user into a particular group policy use the Department field of the Organization tab to enter the name of the group policy. Then create an attribute map, and map Department to the Cisco attribute IETF-Radius-Class.

During authentication, the ASA recovers the value of Department from the server, maps the value to the IETF-Radius-Class, and places User1 in the group policy .Check out the steps to enable the LDAP users in a specific Group Policy

When you are going to click on the user and open the Properties dialog box, you see the Organization tab. In the Organisation tab you need to enter Group-Policy-1 in the Department field as shown below.

Fig 1.2- LDAP Group Policy
Now it’s time to define an attribute map for the LDAP configuration and Map the AD attribute Department to the Cisco attribute IETF-Radius-Class using the below configuration on Cisco ASA Firewall.

RouteXP_ASA(config)# ldap attribute-map group_policy
RouteXP_ASA (config-ldap-attribute-map)# map-name Department IETF-Radius-Class

As you applied the ldap attribute map and map name, now associate the LDAP map with the AAA server as shown below on Cisco ASA Firewall

RouteXP_ASA (config)# aaa-server MS_LDAP host
RouteXP_ASA (config-aaa-server-host)# ldap-attribute-map group_policy 

As you remember we said we create the group policy as Group-Policy-1, we need to add this group policy in the Department field on the server, on the ASA and configure the required policy attributes that will be assigned to the user.

RouteXP_ASA (config)# group-policy Group-policy-1 external server-group LDAP_demo
RouteXP_ASA (config-aaa-server-group)#

Create the VPN connection as the user would, and confirm that the session receives the attributes from Group-Policy1 (and any other applicable attributes from the default group-policy). Now Observe the interaction between the ASA and the server by allowing the debug  ldap 255 command from privileged EXEC mode. 

Authentication successful for user1 to
Retrieving user attributes from server
Retrieved Attributes:
department: value = Group-Policy-1
mapped to IETF-Radius-Class: value = Group-Policy-1

Popular Posts

Powered by Blogger.